PT-2026-60750

CVE-2026-16015

Published

2026-07-17

Updated

2026-07-17

Description by

CVSS 3.1

6.3

Medium

MetricsAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions poco-ai poco-claw versions prior to 0.5.7

Description A flaw in the executor manager API component allows for missing authentication. This occurs within the create task() function located in the executor manager/app/api/v1/tasks.py file. An attacker can perform a manipulation to bypass authentication requirements.

Recommendations Upgrade to version 0.5.7. As a temporary mitigation, restrict access to the create task() function in the executor manager/app/api/v1/tasks.py file.

Exploitability

Exploit

Fix

Impacts

Researchers

Erichen

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

CWE-287: Improper Authentication

Related identifiers