GHSA-q6qc-xp4q-rjq5

Suggest an improvement
Source
https://github.com/advisories/GHSA-q6qc-xp4q-rjq5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q6qc-xp4q-rjq5/GHSA-q6qc-xp4q-rjq5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q6qc-xp4q-rjq5
Aliases
Published
2026-06-01T21:30:42Z
Modified
2026-07-09T13:56:44Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Claw Orchestrator is missing authentication for the component API Endpoint
Details

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.

Database specific 
{
    "cwe_ids":  [
        "CWE-287"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-09T13:38:48Z",
    "nvd_published_at":  "2026-06-01T19:16:21Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @enderfga/claw-orchestrator

Package

Name
@enderfga/claw-orchestrator
View open source insights on deps.dev
Purl
pkg:npm/%40enderfga/claw-orchestrator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.6

Database specific

last_known_affected_version_range 
"<= 3.5.5"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q6qc-xp4q-rjq5/GHSA-q6qc-xp4q-rjq5.json"