PT-2026-45250 · Goclaw · Goclaw

Eric-B · CVE-2026-10218 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GoClaw versions prior to 3.11.4

Description Improper authorization occurs in the auth() function within the internal/http/evolution handlers.go file. This flaw allows a remote attacker to bypass authorization mechanisms.

Recommendations Update to a version later than 3.11.3. As a temporary workaround, restrict access to the auth() function in the internal/http/evolution handlers.go file to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-10218

Affected Products

Goclaw

References · 12

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/1120 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10218.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10218 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10218 · Vendor Advisory
• https://github.com/nextlevelbuilder/goclaw · Note
• https://vuldb.com/cve/CVE-2026-10218 · Note
• https://vuldb.com/vuln/367497 · Note
• https://t.me/cveNotify/165413 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2061355127294877815 · Twitter Post
• https://t.me/CVEtracker/55424 · Telegram Post
• https://vuldb.com/submit/821938 · Note
• https://vuldb.com/vuln/367497/cti · Note