Executive brief
GoClaw, a platform for deploying AI agent teams, contains a security flaw in how it handles command approvals. When an administrator approves a specific command to run 'always,' the system only remembers the name of the file and not its full location. This allows a user with existing access to trick the system into running a different, potentially malicious file with the same name without needing a second approval, leading to unauthorized command execution on the host server.
Technical details
An incorrect authorization vulnerability exists in GoClaw's 'exec' approval flow within `internal/tools/exec_approval.go`. The `extractBin` function uses `filepath.Base` to normalize command paths, storing 'allow-always' decisions based solely on the executable's basename rather than its absolute path or identity. An authenticated attacker with operator-level access can seed the `alwaysAllow` cache by getting a benign pathless command (e.g., `canary-bin`) approved, then execute a malicious binary with the same name from a different directory (e.g., `./canary-bin`). This bypasses the `tools.execApproval.security=allowlist` policy, leading to unauthorized host command execution.
Affected products
- nextlevelbuilder GoClaw up to 3.13.2
Timeline
- 2026-07-18: disclosed: Vulnerability details and PoC published via GitHub and VulDB
- 2026-07-18: advisory