CVE-2026-16017
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the list/remove function in tools/tool_cron.go of the cron Chat Tool component. Missing authorization allows remote manipulation. The exploit is public, and the GitHub issue was closed as 'not planned'.
Risk Assessment
The organization is at risk of remote unauthorized operations on the cron Chat Tool, potentially leading to data integrity breaches and control over scheduled tasks.
Recommendation
Immediately update mosaxiv clawlet to a version above 0.2.10 or apply temporary mitigations such as restricting network access to the cron Chat Tool component.
Other vulnerabilities in mosaxiv clawlet
See all- CVE-2026-15621Medium
A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.
- CVE-2026-15620Medium
A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-15619Medium
A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.
- CVE-2026-15618Medium
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.
Original NVD description (English source)
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".