CVE-2026-10281CWE-287CWE-306

Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication

Medium · published June 1, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00411 · 34.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-06-01T18:15Z
EPSS history
Timeline
  • 01 JUN 18:15Z
    Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication
    cvelistv5