CVE-2026-16123 is a missing authorization vulnerability in nextlevelbuilder GoClaw up to version 3.13.2. Specifically, the ToolsInvokeHandler.ServeHTTP function in the Invoke Endpoint component fails to enforce proper authorization, enabling remote attackers to invoke functionality without required permissions. The vulnerability is confirmed to be exploitable remotely, and exploit code has been publicly disclosed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

This vulnerability allows remote attackers to bypass authorization controls in the affected GoClaw versions, potentially enabling unauthorized access to functionality exposed by the ToolsInvokeHandler.ServeHTTP endpoint. The impact is rated medium with a CVSS score of 5.3, reflecting limited but non-negligible risk. There are no known exploits in the wild beyond the public exploit code availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected endpoint and monitoring for suspicious activity related to ToolsInvokeHandler.ServeHTTP. Avoid deploying affected versions in exposed environments where possible.