The vulnerability CVE-2026-16122 affects nextlevelbuilder GoClaw versions 3.13.0 through 3.13.2. It is caused by incorrect authorization logic in the extractBin/RequestApproval/matchesAllowlist function located in internal/tools/exec_approval.go. This improper authorization can be manipulated to bypass intended access controls. Although an exploit has been publicly released, there is no vendor-provided fix or official remediation level indicated at this time.

The incorrect authorization vulnerability could allow an attacker with some level of privileges to perform unauthorized actions within the affected GoClaw versions. The CVSS score of 4.8 indicates a medium impact, reflecting limited attack vector scope (adjacent network), low complexity, and no user interaction required. The presence of a public exploit increases the risk of exploitation, though no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to affected functions and monitor for suspicious activity related to authorization bypass attempts. No official patch or temporary fix is currently available.