Is CVE-2026-10617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10617 being exploited in the wild.

How severe is CVE-2026-10617?

High severity, with a CVSS score of 7.3, published 2 June 2026.

Which products and versions are affected?

nextlevelbuilder GoClaw 2.8.1 to 3.11.3.

Is there a fix for CVE-2026-10617?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10617 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10617?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10617: nextlevelbuilder GoClaw missing authentication in resolveAuth

CVE-2026-10617 · Severity: high · CVSS 7.3 · Published 2026-06-02

GoClaw, an AI agent platform, contains a security flaw that allows unauthorized users to gain full administrative access if the system is not configured with a specific security token. This could allow an attacker to remotely execute commands, access sensitive files, or modify system configurations. Additionally, the platform may accept fake messages from external services like Feishu or Pancake, potentially triggering unintended automated actions.

Quick answers

Is CVE-2026-10617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10617 being exploited in the wild.
How severe is CVE-2026-10617?: High severity, with a CVSS score of 7.3, published 2 June 2026.
Which products and versions are affected?: nextlevelbuilder GoClaw 2.8.1 to 3.11.3.
Is there a fix for CVE-2026-10617?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10617 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10617?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'fail-open' vulnerability exists in the resolveAuth function within internal/http/auth.go of GoClaw. When the GOCLAW_GATEWAY_TOKEN environment variable is left empty or unconfigured, the system defaults to granting RoleAdmin privileges to any request lacking an Authorization header. This allows unauthenticated remote attackers to access sensitive endpoints such as /v1/tools/invoke and /v1/mcp/servers. Furthermore, webhook handlers for Feishu and Pancake fail to verify signatures or tokens if their respective secrets are unset, enabling the processing of forged payloads. The vulnerability affects versions 2.8.1 through 3.11.3.

Affected products

nextlevelbuilder GoClaw 2.8.1 to 3.11.3

Timeline

2026-06-02: advisory: NVD publication date
2026-06-02: disclosed: Public disclosure of the vulnerability and PoC

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.