PT-2026-60969 · Nextlevelbuilder · Goclaw

Eric-G · CVE-2026-16122 · Published 2026-07-18 · Updated 2026-07-18

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec approval.go. The manipulation results in incorrect authorization. The exploit has been released to the public and may be used for attacks.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2026-16122

Affected Products

Goclaw

References · 8

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/1216 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16122 · Security Note
• https://github.com/nextlevelbuilder/goclaw/issues/1216#issuecomment-4760050291 · Note
• https://vuldb.com/vuln/379831 · Note
• https://vuldb.com/cve/CVE-2026-16122 · Note
• https://vuldb.com/submit/856856 · Note
• https://vuldb.com/vuln/379831/cti · Note
• https://github.com/nextlevelbuilder/goclaw · Note