Is CVE-2026-15621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15621 being exploited in the wild.

How severe is CVE-2026-15621?

Medium severity, with a CVSS score of 5.3, published 14 July 2026.

Is there a fix for CVE-2026-15621?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15621 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-15621?

Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15621: mosaxiv clawlet workspace bypass via hardlink in File Tools

CVE-2026-15621 · Severity: medium · CVSS 5.3 · Published 2026-07-14

mosaxiv clawlet is an AI assistant that includes tools for managing files within a specific restricted workspace. A security flaw allows a local user to bypass these restrictions by using hardlink aliases, which are special file shortcuts that point to the same data on a disk. By creating a link inside the workspace that points to a file outside of it, an attacker can read or modify sensitive system files that should be protected, potentially leading to data theft or unauthorized system changes.

Technologies: Mosaxiv Clawlet. Vendors: Mosaxiv.

Quick answers

Is CVE-2026-15621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15621 being exploited in the wild.
How severe is CVE-2026-15621?: Medium severity, with a CVSS score of 5.3, published 14 July 2026.
Which products and versions are affected?: Mosaxiv Clawlet up to 0.2.10.
Is there a fix for CVE-2026-15621?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15621 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-15621?: Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the File Tools component of mosaxiv clawlet (specifically within tools/fs_ops.go) due to improper link resolution. While the application implements checks against symbolic link traversal and absolute paths to enforce workspace restrictions, it fails to verify if a file is a hardlink alias to an inode located outside the workspace. A local attacker can create a hardlink inside the workspace pointing to a sensitive file on the same filesystem. When the 'read_file', 'write_file', or 'edit_file' functions are called on this link, the application performs the operation on the external file, bypassing the 'restrictToWorkspace' security boundary. The vendor has marked this issue as 'not planned' for fixing.

Affected products

mosaxiv clawlet up to 0.2.10

Timeline

2026-07-14: advisory: NVD publication date
2026-07-13: disclosed: Initial disclosure via VulDB and GitHub issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.