CVE-2026-16017CWE-862CWE-863

mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization

Medium · published July 17, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00366 · 29.2th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-17T14:15Z
EPSS history
Timeline
  • 17 JUL 14:15Z
    mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
    cvelistv5