CVE-2026-10281

HighCVSS 7.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

A missing authentication vulnerability was found in claw-orchestrator up to version 3.5.5 in the EmbeddedServer function in the file src/embedded-server.ts of the API Endpoint component. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

The risk includes the possibility of remote access to the API without authentication, which can lead to unauthorized operations and system integrity compromise.

Recommendation

It is recommended to update claw-orchestrator to version 3.5.6, which includes the fix (d0b02a800aa0689d9428cc4cc170e0b6589fb2c3).

Other vulnerabilities in claw-orchestrator

CVE-2026-10291Medium
The Enderfga claw-orchestrator up to version 3.7.0 has a vulnerability in the validateRegex function of claw-orchestrator/src/embedded-server.ts. Manipulating the body.pattern argument leads to inefficient regular expression complexity, exploitable remotely.

Original NVD description (English source)

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.