CVE-2026-10218: fallo de gravedad media en nextlevelbuilder GoClaw
nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such manipulation leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project tagged the reported issue as bug.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
nextlevelbuilder · GoClawPoCs públicas encontradas — 1
cve_referencegithub.com/nextlevelbuilder/goclaw/issues/1120no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — nextlevelbuilder GoClaw
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-10219MEDIUMnextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injectionEPSS 1.5%CVE-2026-15625MEDIUMnextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklistEPSS 0.5%CVE-2026-16124MEDIUMnextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgeryEPSS 0.5%CVE-2026-15626MEDIUMnextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversalEPSS 0.4%CVE-2026-15627MEDIUMnextlevelbuilder GoClaw tool.go handleNavigate information disclosureEPSS 0.4%CVE-2026-16120MEDIUMnextlevelbuilder GoClaw exec_approval.go extractBin name resolutionEPSS 0.4%