Is CVE-2026-15625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15625 being exploited in the wild.

How severe is CVE-2026-15625?

Medium severity, with a CVSS score of 6.3, published 14 July 2026.

Which products and versions are affected?

Nextlevelbuilder GoClaw <= 3.11.3.

Is there a fix for CVE-2026-15625?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15625 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15625?

Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15625: nextlevelbuilder GoClaw command execution bypass in ExecApprovalManager

Q: Is there a fix for CVE-2026-15625?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15625 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-15625?

Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15625 · Severity: medium · CVSS 6.3 · Published 2026-07-14

GoClaw is a platform used to deploy and manage AI agent teams. A security flaw in its command execution tool allows authorized users to bypass safety restrictions and run unauthorized commands on the underlying server. This could lead to data theft, unauthorized file changes, or full system compromise by bypassing the intended security allowlist.

Technologies: Nextlevelbuilder GoClaw. Vendors: Nextlevelbuilder.

Quick answers

Is CVE-2026-15625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15625 being exploited in the wild.
How severe is CVE-2026-15625?: Medium severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?: Nextlevelbuilder GoClaw <= 3.11.3.
Is there a fix for CVE-2026-15625?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15625 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15625?: Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A policy bypass exists in GoClaw's `exec` tool due to a discrepancy between how commands are validated and how they are executed. The `ExecApprovalManager.CheckCommand` function in `internal/tools/exec_approval.go` validates only the initial command token (e.g., 'env') against an allowlist. However, the execution layer in `ExecTool.executeOnHost` passes the entire original, unparsed command string to `sh -c`. An authenticated attacker with operator privileges can exploit this by prefixing a malicious shell payload with an allowlisted wrapper, resulting in arbitrary command execution on the host.

Affected products

nextlevelbuilder GoClaw <= 3.11.3

Timeline

2026-07-14: disclosed: Vulnerability published via VulDB and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.