Is CVE-2026-14716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14716 being exploited in the wild.

How severe is CVE-2026-14716?

Medium severity, with a CVSS score of 6.3, published 5 July 2026.

Which products and versions are affected?

Nextlevelbuilder GoClaw up to 3.13.0-beta.2.

Is there a fix for CVE-2026-14716?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14716 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14716?

Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14716: nextlevelbuilder GoClaw incorrect authorization in WebSocket RPC Handler

CVE-2026-14716 · Severity: medium · CVSS 6.3 · Published 2026-07-05

GoClaw, a platform for deploying AI agent teams, contains a security flaw in how it handles WebSocket permissions. An attacker with a restricted API key (such as one only allowed to approve tasks) can bypass these restrictions to perform unauthorized actions, like creating scheduled jobs. This allows a user with limited access to modify system settings and data they should not be able to reach.

Technologies: Nextlevelbuilder GoClaw. Vendors: Nextlevelbuilder.

Quick answers

Is CVE-2026-14716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14716 being exploited in the wild.
How severe is CVE-2026-14716?: Medium severity, with a CVSS score of 6.3, published 5 July 2026.
Which products and versions are affected?: Nextlevelbuilder GoClaw up to 3.13.0-beta.2.
Is there a fix for CVE-2026-14716?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14716 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14716?: Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability exists in the `MethodRouter.Handle` function within `internal/gateway/router.go`. The WebSocket RPC implementation derives a coarse `RoleOperator` from specific API key scopes (like `operator.approvals`) during connection but fails to validate the specific granular scopes during subsequent RPC calls. Consequently, the system only checks if the derived role has access to a method, allowing an attacker with a limited-scope API key to invoke unrelated operator-write methods such as `cron.create`. This leads to unauthorized state mutation within the tenant environment. The vulnerability affects GoClaw versions up to 3.13.0-beta.2.

Affected products

nextlevelbuilder GoClaw up to 3.13.0-beta.2

Timeline

2026-07-05: advisory: NVD/VulDB publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.