PocketClawvol. 1 · 2026
vulnerabilitymedium · CVSS 5.4patched

CVE-2026-26330

NitroClaw — IDOR in admin dashboard tenant routing

Summary

NitroClaw's admin dashboard URL pattern allowed authenticated users to read other tenants' agent configurations by changing a numeric tenant ID in the URL. No tool execution leakage. Configurations contained no plaintext secrets.

Details

CVE IDCVE-2026-26330
Severitymedium (5.4)
CVSS vectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published2026-04-12
Patched2026-04-13
Affected versionsPlatform 1.4 – 1.5
Fixed inPlatform 1.6
Exploited in the wildno known exploitation

Affected projects

NitroClaw

What to do

  • If you run an affected version: upgrade to Platform 1.6 immediately. Do not delay this for convenience reasons.
  • Rotate any credentials that may have been exposed via the affected component.
  • Audit your logs for indicators of exploitation — unexpected outbound traffic, anomalous tool calls, unfamiliar authenticated sessions.
  • If exploitation is confirmed, treat the host as compromised: rebuild from a clean image, rotate every secret on the host, audit lateral movement.

Sources

See also: all CVEs, tracked agents, methodology.