CVE-2026-14716

MEDIUM

nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads to incorrect authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-376305 | nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization
https://vuldb.com/vuln/376305
Signature, Permissions Required signature permissions-required
VDB-376305 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/376305/cti
Third Party Advisory third-party-advisory
CVE-2026-14716 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14716
Third Party Advisory third-party-advisory
Submit #847501 | NextLevelBuilder GoClaw 3.13.0-beta.2 Incorrect Authorization (CWE-863)
https://vuldb.com/submit/847501

Scores

CVSS v3 6.3
EPSS 0.0025
EPSS Percentile 16.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-863
Status published
Products (3)
nextlevelbuilder/GoClaw 3.13.0-beta.0
nextlevelbuilder/GoClaw 3.13.0-beta.1
nextlevelbuilder/GoClaw 3.13.0-beta.2
Published Jul 05, 2026
Tracked Since Jul 05, 2026