CVE-2026-16120: nextlevelbuilder GoClaw exec_approval.go extractBin name resolution

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-18 · updated 2026-10-24
Weakness: CWE-706

Description

A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Affected products

nextlevelbuilder GoClaw: 3.13.3-beta.0, 3.13.3-beta.1, 3.13.3-beta.2, 3.13.3-beta.3

References

https://github.com/nextlevelbuilder/goclaw/
https://github.com/nextlevelbuilder/goclaw/issues/1213
https://github.com/nextlevelbuilder/goclaw/issues/1213#issuecomment-4760246569
https://vuldb.com/cve/CVE-2026-16120
https://vuldb.com/submit/856826
https://vuldb.com/vuln/379829
https://vuldb.com/vuln/379829/cti

Get alerted when CVE-2026-16120 or the next vulnerability affects your stack