CVE-2026-10617: nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-02 · updated 2026-07-22
Weakness: CWE-287

Description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

Affected products

nextlevelbuilder GoClaw: 3.11.0, 3.11.1, 3.11.2, 3.11.3

References

https://github.com/nextlevelbuilder/goclaw/
https://github.com/nextlevelbuilder/goclaw/issues/1134
https://vuldb.com/cve/CVE-2026-10617
https://vuldb.com/submit/829421
https://vuldb.com/vuln/367926
https://vuldb.com/vuln/367926/cti

Get alerted when CVE-2026-10617 or the next vulnerability affects your stack