CVE-2026-16017

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16017

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16017.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16017

Published

2026-07-17T14:15:07.811Z

Modified

2026-07-19T03:46:28.209345225Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization

Details

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.2.0"
                },
                {
                    "last_affected": "0.2.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-862",
        "CWE-863"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16017.json"
}

References

Affected packages

Git / github.com/mosaxiv/clawlet

Affected ranges

Type

GIT

Repo

https://github.com/mosaxiv/clawlet

Events

Introduced

bc0e279682b009533be7c9ec6b5dda796fc20ffb

Last affected

c6ea754c8932c16591a973d30a97abb26b9a12a6

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        },
        {
            "introduced": "0.2.2"
        },
        {
            "last_affected": "0.2.2"
        },
        {
            "introduced": "0.2.3"
        },
        {
            "last_affected": "0.2.3"
        },
        {
            "introduced": "0.2.4"
        },
        {
            "last_affected": "0.2.4"
        },
        {
            "introduced": "0.2.5"
        },
        {
            "last_affected": "0.2.5"
        },
        {
            "introduced": "0.2.6"
        },
        {
            "last_affected": "0.2.6"
        },
        {
            "introduced": "0.2.7"
        },
        {
            "last_affected": "0.2.7"
        },
        {
            "introduced": "0.2.8"
        },
        {
            "last_affected": "0.2.8"
        },
        {
            "introduced": "0.2.9"
        },
        {
            "last_affected": "0.2.9"
        },
        {
            "introduced": "0.2.10"
        },
        {
            "last_affected": "0.2.10"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.2.1

0.2.10

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

v0.*

v0.2.1

v0.2.10

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16017.json"