Executive brief
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
Affected products
- crates.io zeptoclaw
Junglewise Threat Intelligence
CVE-2026-32231: ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
CVE-2026-32231 · Severity: low · CVSS 3.1 · Published 2026-03-12
Technologies: zeptoclaw (crates.io). Vendors: crates.io.
Related threats
- ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
- ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
- zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
- zeptoclaw has Android device shell blocklist bypass via argument permutation