CVE-2026-16123

Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw versions prior to 3.13.3

Description An issue in the Invoke Endpoint component allows for missing authorization. This occurs within the ToolsInvokeHandler.ServeHTTP() function located in the internal/http/tools invoke.go file. A remote attacker can exploit this weakness to bypass authorization requirements.

Recommendations Update nextlevelbuilder GoClaw to version 3.13.3 or later. As a temporary mitigation, restrict access to the ToolsInvokeHandler.ServeHTTP() function.