CVE-2026-10617

7.3 HIGH

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3

Published: 2026-06-02 · Last updated: 2026-06-04

Severity and scoring

CVSS: 7.3 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-287, CWE-306

Description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-10617
[Other]https://github.com/nextlevelbuilder/goclaw/
[Other]https://github.com/nextlevelbuilder/goclaw/issues/1134
[Other]https://vuldb.com/cve/CVE-2026-10617
[Other]https://vuldb.com/submit/829421
[Other]https://vuldb.com/vuln/367926
[Other]https://vuldb.com/vuln/367926/cti

Related CVEs

Same CWE

CVE-2026-12183 — Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerabili... (9.8 CRITICAL)
CVE-2026-53868 — Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses ... (7.5 HIGH)
CVE-2026-50287 — AgenticMail gives AI agents real email addresses and phone numbers
CVE-2026-53981 — Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary ... (7.6 HIGH)
CVE-2026-50085 — The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker wit... (8.6 HIGH)