CVE-2026-10281 json
Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication
published 2026-06-01 5 mo ago modified 2026-07-22 3 mo ago also GHSA-q6qc-xp4q-rjq5 , EUVD-2026-33743
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.
Patch / fix
- npm @enderfga/claw-orchestrator 3.5.6
- Enderfga claw-orchestrator 3.5.6
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Enderfga/claw-orchestrator/issues/61 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @enderfga/claw-orchestrator | <3.5.6 |
3.5.6 |
Affected products
- Enderfga claw-orchestrator
Classification
References
-
github.com
/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d9428cc4cc170e0b6589fb2c3
patch, web
-
github.com
/Enderfga/claw-orchestrator/releases/tag/v3.5.6
patch, web
-
github.com
/Enderfga/claw-orchestrator/issues/61
exploit, issue-tracking, web
-
vuldb.com
/vuln/367574
vdb-entry, technical-description, web
-
vuldb.com
/vuln/367574/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-10281
third-party-advisory, web
-
vuldb.com
/submit/825429
third-party-advisory, web
-
github.com
/Enderfga/claw-orchestrator/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-10281
advisory
-
github.com
/Enderfga/claw-orchestrator
package
Sources
- CVE List CVE-2026-10281
- GitHub Advisory GHSA-q6qc-xp4q-rjq5
- NVD CVE-2026-10281
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.