CVE-2026-10281: Missing Authentication in Enderfga claw-orchestrator
CVE-2026-10281 is a medium severity vulnerability in Enderfga claw-orchestrator versions 3.5.0 through 3.5.5. It involves missing authentication in the EmbeddedServer function of the API Endpoint component, allowing remote attackers to potentially access the system without proper authentication. The issue is resolved by upgrading to version 3.5.6. The CVSS 4.0 base score is 6.9, indicating a network attack vector with no privileges or user interaction required.
AI Analysis
Technical Summary
This vulnerability affects Enderfga claw-orchestrator versions 3.5.0 to 3.5.5 and is characterized by missing authentication controls in the EmbeddedServer function of the API Endpoint component. This flaw allows remote attackers to interact with the system without authentication, potentially leading to unauthorized access. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting its medium severity and ease of exploitation over the network without privileges or user interaction. The vendor has addressed the issue in version 3.5.6, which mitigates the vulnerability.
Potential Impact
Remote attackers can exploit the missing authentication in the EmbeddedServer API Endpoint to access the system without credentials. This could lead to unauthorized actions or information disclosure depending on the API's capabilities. The medium severity score reflects a significant but not critical risk, given the lack of required privileges and user interaction.
Mitigation Recommendations
Upgrade Enderfga claw-orchestrator to version 3.5.6 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's version upgrade recommendation.
CVE-2026-10281: Missing Authentication in Enderfga claw-orchestrator
Description
CVE-2026-10281 is a medium severity vulnerability in Enderfga claw-orchestrator versions 3.5.0 through 3.5.5. It involves missing authentication in the EmbeddedServer function of the API Endpoint component, allowing remote attackers to potentially access the system without proper authentication. The issue is resolved by upgrading to version 3.5.6. The CVSS 4.0 base score is 6.9, indicating a network attack vector with no privileges or user interaction required.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/enderfga/claw-orchestratorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Enderfga claw-orchestrator versions 3.5.0 to 3.5.5 and is characterized by missing authentication controls in the EmbeddedServer function of the API Endpoint component. This flaw allows remote attackers to interact with the system without authentication, potentially leading to unauthorized access. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting its medium severity and ease of exploitation over the network without privileges or user interaction. The vendor has addressed the issue in version 3.5.6, which mitigates the vulnerability.
Potential Impact
Remote attackers can exploit the missing authentication in the EmbeddedServer API Endpoint to access the system without credentials. This could lead to unauthorized actions or information disclosure depending on the API's capabilities. The medium severity score reflects a significant but not critical risk, given the lack of required privileges and user interaction.
Mitigation Recommendations
Upgrade Enderfga claw-orchestrator to version 3.5.6 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's version upgrade recommendation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-31T16:18:35.986Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1de300e29bf47b503a4e0a
Added to database: 06/01/2026, 19:52:32 UTC
Last enriched: 07/10/2026, 10:25:30 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.