CVE-2026-10218: medium-severity vulnerability in nextlevelbuilder GoClaw
nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such manipulation leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project tagged the reported issue as bug.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
nextlevelbuilder · GoClawpublic PoCs found — 1
cve_referencegithub.com/nextlevelbuilder/goclaw/issues/1120unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — nextlevelbuilder GoClaw
In the same product, most dangerous first.
CVE-2026-10219MEDIUMnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionEPSS 1.5%CVE-2026-15625MEDIUMnextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklistEPSS 0.5%CVE-2026-16124MEDIUMnextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgeryEPSS 0.5%CVE-2026-15626MEDIUMnextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversalEPSS 0.4%CVE-2026-15627MEDIUMnextlevelbuilder GoClaw tool.go handleNavigate information disclosureEPSS 0.4%CVE-2026-16120MEDIUMnextlevelbuilder GoClaw exec_approval.go extractBin name resolutionEPSS 0.4%