CVE-2026-16017 | A security flaw has been discovered in mosaxiv clawlet up to… | CVSS 6.3 MEDIUM

Description

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".

Metadata

CVE ID: CVE-2026-16017
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-17 05:47 UTC
Published: 2026-07-17 14:15 UTC
Last updated: 2026-07-17 17:27 UTC
Primary CWE: CWE-862
Missing Authorization
Vendor / Product: mosaxiv / clawlet
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
mosaxiv	clawlet	—	0.2.0, 0.2.1, 0.2.2, 0.2.3 …

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	Missing Authorization
CWE-863	cna	Incorrect Authorization

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-379759 | mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization https://vuldb.com/vuln/379759
VDB-379759 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/379759/cti
CVE-2026-16017 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-16017
Submit #856824 | mosaxiv clawlet 0.2.10 Missing Authorization (CWE-862) https://vuldb.com/submit/856824
https://github.com/mosaxiv/clawlet/issues/17
https://github.com/mosaxiv/clawlet/