Executive brief
GoClaw, a tool for deploying AI agent teams, contains a security flaw in how it handles command approvals. When an administrator grants permanent permission for a specific command (like a shell utility), the system mistakenly trusts the entire utility rather than just that specific command. This allows an attacker with basic access to run any unauthorized command on the host system without further approval, potentially leading to full system takeover or data theft.
Technical details
An incorrect authorization vulnerability exists in GoClaw's `RequestApproval` function within `internal/tools/exec_approval.go`. The root cause is a logic flaw in the approval cache where an 'allow-always' decision only persists the base binary name (extracted via `extractBin`) rather than the full command string or execution plan. For multiplexer binaries like BusyBox, approving a single benign command grants permanent trust to the binary itself. A remote attacker with operator-level authentication can exploit this by first getting a benign command approved and subsequently executing arbitrary shell payloads (e.g., `busybox sh -c ...`) without triggering additional approval prompts. This leads to arbitrary command execution with the privileges of the GoClaw process.
Affected products
- nextlevelbuilder GoClaw <= 3.13.2
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory