CVE-2026-16015

MediumCVSS 6.3

Published: 17/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

A vulnerability was found in poco-ai poco-claw up to version 0.5.4, affecting the create_task function in executor_manager/app/api/v1/tasks.py, leading to missing authentication. The exploit has been publicly disclosed and may be used by attackers.

Risk Assessment

The risk involves unauthorized task creation by an attacker, potentially compromising system integrity and allowing control over the application.

Recommendation

It is recommended to upgrade poco-ai poco-claw to version 0.5.7 or later, which includes the fix identified as 67fcc88505c57f77d3fcf04eb5b89425b10cbf48.

Other vulnerabilities in poco-ai poco-claw

CVE-2026-16016High
A server-side request forgery (SSRF) vulnerability was found in poco-ai poco-claw up to version 0.5.4. The issue affects the run_task function in the executor/app/api/v1/task.py file, where the callback_url argument can be manipulated by an attacker. The attack can be carried out remotely, and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.