CVE-2026-10291: Enderfga claw-orchestrator DoS Vulnerability

CVE-2026-10291 Overview

CVE-2026-10291 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting Enderfga claw-orchestrator versions up to and including 3.7.0. The flaw resides in the validateRegex function within claw-orchestrator/src/embedded-server.ts, part of the Session Grep Endpoint. Attackers can remotely manipulate the body.pattern argument to trigger inefficient regular expression complexity, exhausting CPU resources on the host process. The issue is tracked under CWE-400: Uncontrolled Resource Consumption and is resolved in version 3.7.1 via commit 3f970a974c65a94555c25af9f2796f11315e4584.

Critical Impact
A low-privileged remote attacker can submit a crafted regular expression pattern to the /session/grep endpoint, causing catastrophic backtracking and denial of service against the orchestrator process.

Affected Products

Enderfga claw-orchestrator versions up to and including 3.7.0
Component: Session Grep Endpoint (claw-orchestrator/src/embedded-server.ts)
Function: validateRegex processing the body.pattern argument

Discovery Timeline

2026-06-01 - CVE-2026-10291 published to NVD
2026-06-02 - Last updated in NVD database
Patch commit - 3f970a974c65a94555c25af9f2796f11315e4584 released in v3.7.1

Technical Details for CVE-2026-10291

Vulnerability Analysis

The vulnerability is an Algorithmic Complexity Attack against a user-supplied regular expression. The /session/grep endpoint accepts a pattern parameter from the request body and compiles it using the default JavaScript RegExp engine. The native V8 regex engine uses a backtracking NFA implementation, which can exhibit super-linear runtime when evaluating ambiguous patterns against adversarial input.

An attacker who can reach the Session Grep Endpoint can submit a pattern such as (a+)+$ or (.*a){20} against a crafted input string. The engine attempts exponential backtracking paths, pinning a single Node.js event-loop thread to 100% CPU. Because Node.js is single-threaded for JavaScript execution, the entire orchestrator becomes unresponsive to legitimate requests.

Root Cause

The root cause is the absence of bounded-time regex evaluation in validateRegex and related call sites in session-manager.ts and validation.ts. User-controlled patterns reached the V8 RegExp engine without timeout protection, input length limits, or use of a linear-time engine.

Attack Vector

Exploitation is performed remotely over the network with low privileges and no user interaction. The attacker issues an HTTP request to the Session Grep Endpoint with a malicious pattern value. The patch replaces the unsafe RegExp constructor with RE2, a linear-time regex library that does not support backtracking.

typescript

// Patch: src/session-manager.ts (v3.7.1)
 const execFileAsync = promisify(execFile);
 import * as http from 'node:http';
 import { createRequire } from 'node:module';
+import RE2 from 're2';
 
 const _require = createRequire(import.meta.url);
 function getPluginVersion(): string {

typescript

// Patch: src/validation.ts (v3.7.1)
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
+import RE2 from 're2';
 
 // ─── Blocked Path Prefixes ─────────────────────────────────────────────────

Source: GitHub Commit 3f970a9

Detection Methods for CVE-2026-10291

Indicators of Compromise

Sustained 100% CPU utilization on the Node.js process hosting claw-orchestrator with no corresponding increase in legitimate request volume.
HTTP requests to the /session/grep endpoint containing nested quantifiers or alternation patterns such as (a+)+, (a|a)+, or (.*)+.
Event-loop lag warnings or unresponsiveness in claw-orchestrator logs after specific grep requests.

Detection Strategies

Inspect HTTP access logs for POST requests to /session/grep with unusually long or syntactically complex pattern values.
Implement application-layer monitoring of regex compilation and execution time, alerting when evaluation exceeds a fixed threshold such as 100ms.
Correlate spikes in process CPU usage with concurrent requests to the Session Grep Endpoint using observability tooling.

Monitoring Recommendations

Enable Node.js performance hooks to record per-request handler duration on the orchestrator.
Forward web server access logs to a centralized analytics platform and create rules for repeated requests with high-entropy pattern parameters.
Track restart counts and out-of-memory events for the claw-orchestrator service as secondary signals of resource exhaustion.

How to Mitigate CVE-2026-10291

Immediate Actions Required

Upgrade claw-orchestrator to version 3.7.1 or later, which integrates the RE2 engine for user-supplied regex evaluation.
Restrict network exposure of the Session Grep Endpoint to trusted clients using firewall rules or reverse-proxy ACLs.
Audit existing deployments for unauthorized requests to /session/grep since the vulnerable versions were deployed.

Patch Information

The fix is committed as 3f970a974c65a94555c25af9f2796f11315e4584 and released as v3.7.1. The patch imports the re2 module in both src/session-manager.ts and src/validation.ts, replacing native RegExp usage for user-controlled patterns. Refer to GitHub Issue #64 and the VulDB entry for additional context.

Workarounds

If immediate upgrade is not possible, disable or remove the /session/grep route from the embedded HTTP server.
Place the orchestrator behind a reverse proxy that enforces strict limits on request body size and rejects pattern fields exceeding a small character budget.
Require authentication and rate limiting on all Session Grep Endpoint requests to reduce the attack surface.

bash

# Upgrade to the patched release
npm install claw-orchestrator@3.7.1

# Verify installed version
npm ls claw-orchestrator | grep claw-orchestrator