A critical authentication bypass and authorization vulnerability in nextlevelbuilder GoClaw and GoClaw Lite permits unauthenticated remote attackers to achieve arbitrary command execution on the host.

The vulnerability stems from an authentication interceptor that fails to reject invalid tokens, defaulting to a viewer role, combined with a default-permit RBAC policy. This allows an unauthenticated remote attacker to inject malicious payloads into heartbeat endpoints and execute arbitrary commands on the underlying host via the agent execution tool.

The potential for unauthenticated remote code execution poses a severe risk to organizational infrastructure, as attackers can gain full control over the host system. Successful exploitation could lead to total compromise of sensitive data, unauthorized lateral movement within the network, and significant operational disruption. While the provided CVSS score is 7.3, the technical reality of the vulnerability, including the potential for code execution, warrants treating this as a critical priority.

Immediate Action: Upgrade to version 3.9.0 or later immediately to apply the necessary authentication and authorization fixes.

Proactive Monitoring: Review access logs for anomalous RPC calls, specifically monitoring for heartbeat.set and logs.tail requests originating from unrecognized or untrusted sources.

Compensating Controls: Implement strict network-level access control lists to restrict access to the GoClaw gateway to authorized IP addresses only. Deploy a Web Application Firewall to block suspicious heartbeat traffic and unexpected command patterns.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced in the vendor's own tracking system.

This vulnerability represents a critical security failure in the authentication and authorization architecture of the GoClaw platform. Given the availability of technical details and the potential for remote command execution, organizations must prioritize upgrading to version 3.9.0. Failure to patch this issue leaves systems exposed to trivial, unauthenticated remote attacks that could result in total system compromise.