goclowl Cross-Agent Authorization Bypass in /v1/tools/invoke allowing unauthorized cron binding (PoC included)

[Security] Cross-Agent Authorization Bypass in /v1/tools/invoke Allows Unauthorized Cron Binding to Foreign Agents #1217 Vulnerability Overview Title: Cross-Agent Authorization Bypass in /v1/tools/invoke Allows Unauthorized Cron Binding to Foreign Agents Description: An authenticated caller with only permissions can use the documented HTTP tool invocation endpoint to create a cron job bound to another user's private agent. Directly reading the same foreign agent is correctly blocked with a 403, but the cron creation path accepts an attacker-controlled without performing an access check, allowing unauthorized bindings to be persisted in . This creates a stored cross-agent authorization bypass, which the scheduler later trusts as an execution target. Details: The flaw lies in the HTTP direct tool entry point. In , the handler accepts the top-level request field , resolves it using , and injects the resolved UUID into the context via , but never calls . PoC Prerequisites: - Clone the canonical repository https://github.com/nextlevelbuilder/goclowl - Install Python 3 locally - Have a Go toolchain available to build the binary - No external models/providers are required to demonstrate the vulnerability binding - The PoC assumes localhost access and starts an isolated SQLite backend gateway instance at 127.0.0.1:18891 Reproduction Steps: 1. Download the PoC helper from 2. Download the PoC verification from 3. Download the control script from 4. Place the three files in the same directory 5. Run the PoC verification from the repository directory 6. Confirm baseline protection is effective 7. Confirm the vulnerable path succeeds 8. Confirm unauthorized binding persistence 9. Run the control case 10. Confirm the control stays within scope Scope Ecosystem: go Package: github.com/nextlevelbuilder/goclowl Affected Versions: <= 3.13.2 Patched Version: None Severity: High Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-862: Missing Authorization Remediation Maintainer Follow-up: - Issue confirmed, not assigned - Fix required (triage from mrgoonie, unchanged): 1. Enforce or equivalent authorization before accepting any request targeting an agent in 2. Validate/Reject overrides of within the cron tool path 3. Add regression tests: Foreign agent read returns 403, foreign cron addition fails, same-owner cron addition succeeds - Code Entry Points: - L95-103 — Missing check - L331-339 — Reference for how is used - L152-165, L291-296 — Agent ID parsing and override - L55-80 — Persistence without ownership check - Request: Request sprint assignment or direct maintainer fix PoC Code

Goal Reached Thanks to every supporter — we hit 100%!

goclowl Cross-Agent Authorization Bypass in /v1/tools/invoke allowing unauthorized cron binding (PoC included)

More from this source