CVE-2026-18038: nextlevelbuilder GoClaw Information Disclosure in jq Handler

CVE-2026-18038 · Severity: medium · CVSS 4.3 · Published 2026-07-28

GoClaw, an AI agent deployment platform, contains a security flaw that allows authenticated users with 'operator' privileges to steal sensitive system credentials. By using specifically crafted commands through the platform's built-in tools, an attacker can extract the gateway's secret access tokens. These stolen tokens could then be used to gain broader control over the entire GoClaw environment, potentially compromising customer data and AI operations.

Technologies: Nextlevelbuilder GoClaw. Vendors: Nextlevelbuilder.

Quick answers

Is CVE-2026-18038 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18038 being exploited in the wild.
How severe is CVE-2026-18038?
Medium severity, with a CVSS score of 4.3, published 28 July 2026.
Which products and versions are affected?
Nextlevelbuilder GoClaw <= 3.13.2.
Is there a fix for CVE-2026-18038?
A patch was published on 2026-06-15: Fix merged via PR 1230 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18038 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-18038?
Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in GoClaw up to version 3.13.2 within the `ExecTool.Execute` function of `internal/http/tools_invoke.go`. When the platform is configured with `tools.execApproval.security=full` and `tools.execApproval.ask=on-miss`, the `jq` binary is treated as a 'safe' executable and is auto-approved for execution. However, the host execution environment fails to scrub sensitive variables like `GOCLAW_GATEWAY_TOKEN` and `GOCLAW_ENCRYPTION_KEY` before spawning the child process. An authenticated attacker with at least 'operator' privileges can invoke `jq` to read these environment variables, bypassing shell-based deny patterns. This allows for credential exfiltration and subsequent privilege escalation against the gateway APIs. A fix was introduced in pull request 1230.

Affected products

  • nextlevelbuilder GoClaw <= 3.13.2

Timeline

  • 2026-06-13: other: Vulnerability reproduction and PoC confirmed
  • 2026-06-15: patched: Fix merged via PR 1230
  • 2026-07-28: disclosed: CVE-2026-18038 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.