CVE-2026-15622: Poco-AI Poco-Claw Auth Bypass Vulnerability

CVE-2026-15622 Overview

CVE-2026-15622 is an authorization bypass vulnerability affecting poco-ai poco-claw versions up to and including 0.5.4. The flaw resides in the get_workspace_file function within executor_manager/app/api/v1/workspace.py, part of the Workspace API component. An attacker can manipulate the user_id argument to bypass authorization checks and access workspace resources belonging to other users. The attack is remotely exploitable over the network without authentication. A public exploit has been released, and a patch identified by commit hash 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 is available. The weakness is categorized under CWE-285: Improper Authorization.

Critical Impact
Remote attackers can bypass authorization on the Workspace API by manipulating the user_id parameter, gaining unauthorized read access to workspace files across tenant boundaries.

Affected Products

poco-ai poco-claw versions up to 0.5.4
Component: Workspace API (executor_manager/app/api/v1/workspace.py)
Function: get_workspace_file

Discovery Timeline

2026-07-14 - CVE-2026-15622 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15622

Vulnerability Analysis

The vulnerability originates in the get_workspace_file endpoint of the poco-claw executor manager. The function accepts a user_id argument from the client and uses it to locate and return workspace files. Because the endpoint fails to validate that the caller is authorized to act on behalf of the specified user_id, an attacker can substitute another user's identifier to retrieve files they should not access.

The patch commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 addresses the root issue by introducing an X-Internal-Token header requirement for internal manager APIs. Backend service clients are updated to attach the token from settings.internal_api_token, ensuring that only authenticated internal callers can invoke privileged executor manager endpoints. This closes the trust gap where the manager API previously accepted arbitrary user_id values without validating the caller.

Root Cause

The underlying weakness is CWE-285: Improper Authorization. The Workspace API trusted a client-supplied user_id as an authoritative identity claim. No server-side authorization check tied the request to an authenticated session or verified that the caller had legitimate access to the target user's workspace.

Attack Vector

Exploitation requires only network access to the Workspace API. An attacker sends a crafted HTTP request to the get_workspace_file endpoint with a user_id value corresponding to a victim account. The server returns the requested workspace file without validating the caller's identity. No authentication, privileges, or user interaction are required.

python

# Patch excerpt: backend/app/api/v1/schedules.py
     url = f"{settings.executor_manager_url}/api/v1/schedules"
 
     try:
-        headers = {"accept": "application/json"}
+        headers = {
+            "accept": "application/json",
+            "X-Internal-Token": settings.internal_api_token,
+        }
         request_id = get_request_id()
         if request_id:
             headers["X-Request-ID"] = request_id
# Source: https://github.com/poco-ai/poco-claw/commit/67fcc88505c57f77d3fcf04eb5b89425b10cbf48

python

# Patch excerpt: backend/app/services/executor_manager_client.py
     def __init__(self) -> None:
         settings = get_settings()
         self._base_url = (settings.executor_manager_url or "").rstrip("/")
+        self._internal_headers = {"X-Internal-Token": settings.internal_api_token}
         self._client = httpx.Client(
             base_url=self._base_url,
             timeout=httpx.Timeout(connect=3.0, read=10.0, write=10.0, pool=3.0),
# Source: https://github.com/poco-ai/poco-claw/commit/67fcc88505c57f77d3fcf04eb5b89425b10cbf48

Detection Methods for CVE-2026-15622

Indicators of Compromise

Requests to /api/v1/workspace endpoints where the user_id query parameter does not match the authenticated session's user identifier.
Successful HTTP 200 responses to get_workspace_file calls that lack an X-Internal-Token header on internal service paths.
Access patterns showing a single source IP iterating through sequential or enumerated user_id values against the Workspace API.

Detection Strategies

Deploy application-layer logging to record user_id parameter values alongside the authenticated principal for every Workspace API call, and alert on mismatches.
Instrument the reverse proxy or API gateway to flag requests to executor manager endpoints that arrive without the required X-Internal-Token header.
Correlate workspace file access logs with authentication events to identify horizontal privilege escalation attempts.

Monitoring Recommendations

Monitor egress from the Workspace API service for unusually high volumes of file retrieval responses to a single client.
Track 4xx and 5xx response ratios on /api/v1/workspace/* routes for spikes that may indicate enumeration activity.
Review historical access logs for prior exploitation attempts targeting the get_workspace_file function before the patch was applied.

How to Mitigate CVE-2026-15622

Immediate Actions Required

Upgrade poco-ai poco-claw to a version that includes commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 or later.
Configure the internal_api_token setting in the backend so that manager API clients propagate the X-Internal-Token header on every request.
Restrict network reachability of the executor manager service to trusted backend components only, using firewall rules or service mesh policies.
Audit workspace file access logs for signs of prior authorization bypass activity.

Patch Information

The fix is published as commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 in the poco-ai/poco-claw repository. The change requires an X-Internal-Token header for all executor manager API calls, ensuring that only authenticated internal services can access privileged endpoints. Additional context is available in GitHub Issue #133 and Pull Request #135.

Workarounds

Place the executor manager service behind a network boundary that only backend components can reach, blocking direct client access.
Add a reverse proxy rule that rejects requests to /api/v1/workspace/* when the X-Internal-Token header is missing or invalid.
Implement server-side authorization checks that validate the caller's session identity against the requested user_id before returning workspace data.

bash

# Example NGINX rule to enforce internal token on executor manager routes
location /api/v1/ {
    if ($http_x_internal_token != "$INTERNAL_API_TOKEN") {
        return 403;
    }
    proxy_pass http://executor_manager_upstream;
}