Executive brief
GoClaw, a platform for deploying AI agent teams, contains a security flaw in its command approval system. While the system is designed to require human oversight for risky commands, it incorrectly classifies certain file-writing and data-reading commands (like 'sort' and 'grep') as always safe. An authorized user could exploit this to bypass approval workflows, allowing them to modify files or read sensitive data within the workspace without authorization.
Technical details
An improper authorization vulnerability exists in GoClaw's `ExecApprovalManager.CheckCommand` function within `internal/tools/exec_approval.go`. When `tools.execApproval.security` is set to 'full' and `ask` is set to 'on-miss', the system auto-approves commands based solely on the binary's basename if it exists in a hardcoded `safeBins` list. Because the logic fails to inspect command-line arguments, binaries like `sort` (using `-o` for file writes) and `grep` (using `-R` for recursive directory reads) can be used to perform unauthorized file operations. An authenticated attacker with 'Operator' privileges can trigger this remotely via the `POST /v1/tools/invoke` endpoint to bypass the human-in-the-loop approval requirement.
Affected products
- nextlevelbuilder GoClaw up to 3.13.2
Timeline
- 2026-07-18: disclosed: Vulnerability reported and published via VulDB and NVD.