CVE-2026-17531
Received Received - Intake

Authorization Bypass in DroidClaw File Server

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulDB

Description
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17531
EUVD
EUVD-2026-49374

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
unitedbyai droidclaw to 0.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the DroidClaw automation framework up to version 0.5.3. It involves an unsigned scheduled callback that allows attackers to rebind a stored session to another user's online device. The issue occurs when the signing key environment variable is unset, enabling forged callbacks without verification. Attackers can exploit the POST /goals/execute endpoint by manipulating deviceId and userId parameters after only validating sessionId, redirecting legitimate sessions to victim devices.

Detection Guidance

Check if the /goals/execute endpoint is exposed on your network by inspecting web server logs for POST requests to this path. Verify if QSTASH_CURRENT_SIGNING_KEY is unset in environment variables. Monitor WebSocket connections for unexpected device bindings or session redirections.

Impact Analysis

If exploited, this vulnerability could allow unauthorized command execution on your connected device through the legitimate automation pipeline. Attackers could send unintended commands to your device, such as opening settings or performing other actions, without your knowledge or consent. This requires a reachable endpoint, unset signing key, valid session ID, and your device being connected via WebSocket.

Mitigation Strategies

Set QSTASH_CURRENT_SIGNING_KEY to a strong value to enable signature verification. Update DroidClaw to the latest version beyond 0.5.3. Restrict access to the /goals/execute endpoint using network firewalls or authentication. Audit existing sessions for unauthorized bindings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart