Is CVE-2026-10616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10616 being exploited in the wild.

How severe is CVE-2026-10616?

Medium severity, with a CVSS score of 4.3, published 2 June 2026.

Which products and versions are affected?

Nextlevelbuilder GoClaw up to 3.11.3.

Is there a fix for CVE-2026-10616?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10616 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10616?

Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10616: nextlevelbuilder GoClaw authorization bypass in TeamTasksTool

CVE-2026-10616 · Severity: medium · CVSS 4.3 · Published 2026-06-02

GoClaw is an AI agent platform used to deploy and manage teams of autonomous agents. A security flaw in the team task management component allows an authenticated team member to interfere with tasks assigned to other members. An attacker could mark a teammate's active task as complete and replace the legitimate results with their own data, potentially corrupting business workflows, automated approvals, and audit trails.

Technologies: Nextlevelbuilder GoClaw. Vendors: Nextlevelbuilder.

Quick answers

Is CVE-2026-10616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10616 being exploited in the wild.
How severe is CVE-2026-10616?: Medium severity, with a CVSS score of 4.3, published 2 June 2026.
Which products and versions are affected?: Nextlevelbuilder GoClaw up to 3.11.3.
Is there a fix for CVE-2026-10616?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10616 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10616?: Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the `TeamTasksTool.executeComplete` function within `internal/tools/team_tasks_lifecycle.go`. The vulnerability stems from two logic flaws: first, the `executeComplete` function attempts to claim a task but ignores any resulting errors (such as the task already being owned); second, the underlying `CompleteTask` storage operation only validates the task ID, status, and team/tenant IDs without verifying that the requesting agent is the actual owner of the task. A remote attacker with low-privileged authenticated access can exploit this by invoking the `team_tasks` tool with the `complete` action for a known `task_id`. This allows the attacker to overwrite task results, which can disrupt downstream agent orchestration and compromise the integrity of the task audit history.

Affected products

nextlevelbuilder GoClaw up to 3.11.3

Timeline

2026-06-02: disclosed: Vulnerability reported via GitHub issue and VulDB
2026-06-02: advisory: NVD published CVE-2026-10616

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.