Description
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.
References8
- github.com/Enderfga/claw-orchestrator/
- github.com/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d94…
- github.com/Enderfga/claw-orchestrator/issues/61
- github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6
- vuldb.com/cve/CVE-2026-10281
- vuldb.com/submit/825429
- vuldb.com/vuln/367574
- vuldb.com/vuln/367574/cti
Metrics
- CVSS 3.1
-
7.3
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 4.0
-
5.5
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 36 · as of 15 November 2026
- CWE
- CWE-287CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.