CVE-2026-16122— nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nextlevelbuilder | GoClaw | 3.13.0 | affected |
3.13.1 | affected | ||
3.13.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16122
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization
Source: NVD (National Vulnerability Database)
Vulnerability Description
A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec_approval.go. The manipulation results in incorrect authorization. The exploit has been released to the public and may be used for attacks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nextlevelbuilder | GoClaw | 3.13.0 | cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-16122
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16122
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16122 (1)
Proof of Concept for CVE-2026-16122 (1)
Other References for CVE-2026-16122 (1)
Same Patch Batch · nextlevelbuilder · 2026-07-18 · 6 CVEs total
| CVE-2026-16119 | 6.3 MEDIUM | nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval autho |
| CVE-2026-16120 | 6.3 MEDIUM | nextlevelbuilder GoClaw exec_approval.go extractBin name resolution |
| CVE-2026-16121 | 6.3 MEDIUM | nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization |
| CVE-2026-16123 | 6.3 MEDIUM | nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP autho |
| CVE-2026-16124 | 6.3 MEDIUM | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery |
IV. Related Vulnerabilities
Same product: GoClaw
- CVE-2026-16199
nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execut - CVE-2026-16124
nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP - CVE-2026-16123
nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go Tool - CVE-2026-16121
nextlevelbuilder GoClaw exec_approval.go isSafeBin improper - CVE-2026-16120
nextlevelbuilder GoClaw exec_approval.go extractBin name res
Same vendor: nextlevelbuilder
- CVE-2026-16199
nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execut - CVE-2026-16124
nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP - CVE-2026-16123
nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go Tool - CVE-2026-16121
nextlevelbuilder GoClaw exec_approval.go isSafeBin improper - CVE-2026-16120
nextlevelbuilder GoClaw exec_approval.go extractBin name res
Same weakness: CWE-863
- CVE-2026-47128
nono: Sandbox escape on Linux via D-Bus: `systemd-run --user - CVE-2026-44507
Rsync: hostname/ACL bypass on DNS-lookup failure - CVE-2026-64650
AI SDK Codex Harness Tool Relay Authorization Bypass - CVE-2026-64651
AI SDK OpenCode Harness Tool Relay Authorization Bypass - CVE-2026-63755
SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
V. Comments for CVE-2026-16122
No comments yet