PT-2026-45821 · Goclaw · Goclaw

Eric-H · CVE-2026-10617 · Published 2026-06-02 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GoClaw versions prior to 3.11.4

Description An issue in the Webhook Verification Handler component allows for missing authentication. This occurs within the resolveAuth() function located in the internal/http/auth.go file, enabling remote exploitation.

Recommendations Update to version 3.11.4 or later. As a temporary workaround, restrict access to the resolveAuth() function in the Webhook Verification Handler.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-10617

Affected Products

Goclaw

References · 10

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/1134 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10617.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10617 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10617 · Vendor Advisory
• https://github.com/nextlevelbuilder/goclaw · Note
• https://vuldb.com/submit/829421 · Note
• https://vuldb.com/vuln/367926/cti · Note
• https://vuldb.com/cve/CVE-2026-10617 · Note
• https://t.me/cveNotify/165992 · Telegram Post
• https://vuldb.com/vuln/367926 · Note