CVE-2026-16122 Overview
CVE-2026-16122 is an incorrect authorization vulnerability in nextlevelbuilder/goclaw versions up to and including 3.13.2. The flaw resides in the extractBin, RequestApproval, and matchesAllowlist functions within internal/tools/exec_approval.go. Manipulation of these functions results in improper authorization decisions, allowing actions that should be blocked by the execution approval mechanism. The weakness is classified under [CWE-285: Improper Authorization]. A public exploit has been disclosed, though exploitation requires adjacent network access and high privileges, limiting practical attack scenarios.
Critical Impact
Attackers with adjacent network access and elevated privileges can bypass GoClaw's execution approval controls, leading to unauthorized command execution within the affected tool's trust boundary.
Affected Products
- nextlevelbuilder GoClaw versions up to 3.13.2
- Component: internal/tools/exec_approval.go
- Functions: extractBin, RequestApproval, matchesAllowlist
Discovery Timeline
- 2026-07-18 - CVE-2026-16122 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16122
Vulnerability Analysis
GoClaw implements an execution approval workflow that gates which binaries and commands may run through the tool. This workflow relies on RequestApproval to prompt or confirm authorization, extractBin to parse the requested binary path, and matchesAllowlist to verify the request against a configured allowlist. A logic flaw across these three functions causes the allowlist check to return an incorrect authorization decision for certain inputs.
Because the vulnerability sits in the authorization layer rather than in code parsing, an attacker who can influence approval requests can cause the tool to execute or approve binaries that the allowlist policy would otherwise deny. The public exploit demonstrates the bypass but requires the attacker to already hold elevated privileges on an adjacent network position.
Root Cause
The root cause is improper authorization logic [CWE-285] in matchesAllowlist, where binary path extraction performed by extractBin does not align with the matching semantics enforced by the allowlist. The mismatch permits crafted binary references to pass the allowlist check even when the resolved binary is not authorized. RequestApproval then proceeds as if the request were permitted.
Attack Vector
Exploitation requires adjacent network access with high privileges and no user interaction. An authenticated actor issues a crafted approval request whose binary reference is normalized differently by extractBin than by matchesAllowlist, bypassing the intended allowlist boundary. See the GitHub Issue #1216 and VulDB CVE-2026-16122 entry for the disclosed proof of concept.
No verified code examples are available. The vulnerability mechanism is described in prose based on the disclosed advisory; refer to the linked references for reproduction details.
Detection Methods for CVE-2026-16122
Indicators of Compromise
- Approval requests in GoClaw logs referencing binaries outside the intended allowlist that were nonetheless approved.
- Discrepancies between the binary path submitted to RequestApproval and the binary ultimately executed.
- Unexpected child processes spawned by the GoClaw process on hosts running versions at or below 3.13.2.
Detection Strategies
- Audit GoClaw approval logs and correlate extractBin output with the effective binary executed to surface path normalization mismatches.
- Compare running GoClaw versions across the environment against the fixed release and flag any host at or below 3.13.2.
- Alert on any GoClaw approval event where the allowlist decision does not match a re-evaluation of the request performed out-of-band.
Monitoring Recommendations
- Enable verbose logging for the execution approval subsystem and forward events to a centralized log store for retention and query.
- Monitor process ancestry on hosts running GoClaw to identify unexpected binaries launched under the tool's context.
- Track adjacent-network authentication events tied to accounts with high privileges on GoClaw hosts.
How to Mitigate CVE-2026-16122
Immediate Actions Required
- Inventory all systems running nextlevelbuilder/goclaw and identify installations at version 3.13.2 or earlier.
- Restrict adjacent network access to hosts running GoClaw and enforce least privilege for accounts able to submit approval requests.
- Review recent GoClaw approval logs for suspicious binary references that may indicate exploitation attempts.
Patch Information
At the time of publication, no vendor patch reference is listed in the NVD entry. Consult the GoClaw project repository and GitHub Issue #1216 for updated release information and remediation status.
Workarounds
- Tighten the GoClaw allowlist to only fully qualified binary paths, reducing the surface for path-normalization mismatches between extractBin and matchesAllowlist.
- Limit which principals may invoke RequestApproval through operating system or network-level access controls until a patched release is deployed.
- Where feasible, disable the execution approval feature or replace it with an out-of-band approval mechanism until the flaw is remediated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
