CVE-2026-16122
Received Received - Intake

Incorrect Authorization in GoClaw up to 3.13.2

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulDB

Description
A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec_approval.go. The manipulation results in incorrect authorization. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2026-16122
EUVD
EUVD-2026-45383

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nextlevelbuilder goclaw to 3.13.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in GoClaw up to version 3.13.2, specifically in the exec approval mechanism. The flaw allows an attacker to bypass authorization checks by exploiting how the system stores and reuses command approvals based on basenames rather than full paths. When an operator approves a command like 'canary-bin', the system caches this approval under just the basename. Later, a different executable with the same basename but different path can reuse this approval, bypassing intended security controls.

Detection Guidance

Check GoClaw versions up to 3.13.2 for the vulnerable exec approval mechanism. Inspect internal/tools/exec_approval.go for the extractBin/RequestApproval/matchesAllowlist functions. Look for approvals cached under basename keys in the alwaysAllow map. Verify if operators approved pathless commands that could be reused for different executables with the same basename.

Impact Analysis

An authenticated operator-level attacker could exploit this to execute arbitrary binaries from a writable workspace on the host without additional approval. This undermines the security policy requiring human confirmation for new commands, potentially leading to unauthorized actions, privilege escalation, or compromise of the GoClaw deployment.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized command execution, potentially violating access control requirements in GDPR (data protection) and HIPAA (health data security). It undermines role-based access control and audit mechanisms, risking unauthorized data access or modification if exploited.

Mitigation Strategies

Upgrade GoClaw to versions after 3.13.2 where the patch is available. Review and revoke any cached approvals for commands with basename-only keys. Disable the allowlist security mode or set ask=always to require manual confirmation for all new commands. Audit all approved executables and restrict writable workspace access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart