PT-2026-60970 · Nextlevelbuilder · Goclaw

Eric-G · CVE-2026-16123 · Published 2026-07-18 · Updated 2026-07-18

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/tools invoke.go of the component Invoke Endpoint. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-16123

Affected Products

Goclaw

References · 8

• 🔥 https://github.com/nextlevelbuilder/goclaw/issues/1217 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16123 · Security Note
• https://github.com/nextlevelbuilder/goclaw/issues/1217#issuecomment-4759982122 · Note
• https://vuldb.com/cve/CVE-2026-16123 · Note
• https://vuldb.com/submit/856857 · Note
• https://vuldb.com/vuln/379832/cti · Note
• https://github.com/nextlevelbuilder/goclaw · Note
• https://vuldb.com/vuln/379832 · Note