CVE-2026-10281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10281", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-31T16:18:35.986Z", "datePublished": "2026-06-01T18:15:10.669Z", "dateUpdated": "2026-06-01T21:19:41.045Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-01T18:15:10.669Z"}, "title": "Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "Missing Authentication"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "Enderfga", "product": "claw-orchestrator", "versions": [{"version": "3.5.0", "status": "affected"}, {"version": "3.5.1", "status": "affected"}, {"version": "3.5.2", "status": "affected"}, {"version": "3.5.3", "status": "affected"}, {"version": "3.5.4", "status": "affected"}, {"version": "3.5.5", "status": "affected"}, {"version": "3.5.6", "status": "unaffected"}], "cpes": ["cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:*"], "modules": ["API Endpoint"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-05-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-31T18:23:39.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ybdesire (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/367574", "name": "VDB-367574 | Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367574/cti", "name": "VDB-367574 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10281", "name": "CVE-2026-10281 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/825429", "name": "Submit #825429 | Enderfga claw-orchestrator v2.7.1-v3.5.5 Missing Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/issues/61", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d9428cc4cc170e0b6589fb2c3", "tags": ["patch"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6", "tags": ["patch"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T21:19:23.470661Z", "id": "CVE-2026-10281", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T21:19:41.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10281", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T21:19:23.470661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T21:19:30.138Z"}}], "cna": {"tags": ["x_open-source"], "title": "Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication", "credits": [{"lang": "en", "type": "reporter", "value": "ybdesire (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:*"], "vendor": "Enderfga", "modules": ["API Endpoint"], "product": "claw-orchestrator", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}, {"status": "affected", "version": "3.5.2"}, {"status": "affected", "version": "3.5.3"}, {"status": "affected", "version": "3.5.4"}, {"status": "affected", "version": "3.5.5"}, {"status": "unaffected", "version": "3.5.6"}]}], "timeline": [{"lang": "en", "time": "2026-05-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-31T18:23:39.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/367574", "name": "VDB-367574 | Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367574/cti", "name": "VDB-367574 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10281", "name": "CVE-2026-10281 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/825429", "name": "Submit #825429 | Enderfga claw-orchestrator v2.7.1-v3.5.5 Missing Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/issues/61", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d9428cc4cc170e0b6589fb2c3", "tags": ["patch"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6", "tags": ["patch"]}, {"url": "https://github.com/Enderfga/claw-orchestrator/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-01T18:15:10.669Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10281", "state": "PUBLISHED", "dateUpdated": "2026-06-01T21:19:41.045Z", "dateReserved": "2026-05-31T16:18:35.986Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-01T18:15:10.669Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:*"], "modules": ["API Endpoint"], "product": "claw-orchestrator", "vendor": "Enderfga", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}, {"status": "affected", "version": "3.5.2"}, {"status": "affected", "version": "3.5.3"}, {"status": "affected", "version": "3.5.4"}, {"status": "affected", "version": "3.5.5"}, {"status": "unaffected", "version": "3.5.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded."}, {"lang": "es", "value": "Se ha identificado una debilidad en Enderfga claw-orchestrator hasta 3.5.5. Esto afecta a la funci\u00f3n EmbeddedServer del archivo src/embedded-server.ts del componente API Endpoint. Esta manipulaci\u00f3n causa autenticaci\u00f3n faltante. El ataque puede ser iniciado remotamente. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser usado para ataques. La actualizaci\u00f3n a la versi\u00f3n 3.5.6 mitiga este problema. Nombre del parche: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. El componente afectado deber\u00eda ser actualizado."}], "id": "CVE-2026-10281", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10281", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T21:19:23.470661Z", "version": "2.0.3"}}]}, "published": "2026-06-01T19:16:21.187", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Enderfga/claw-orchestrator/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d9428cc4cc170e0b6589fb2c3"}, {"source": "cna@vuldb.com", "url": "https://github.com/Enderfga/claw-orchestrator/issues/61"}, {"source": "cna@vuldb.com", "url": "https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-10281"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/825429"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367574"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367574/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.5.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "claw-orchestrator", "source": "cna", "vendor": "Enderfga"}, "product": "claw-orchestrator", "vendor": "enderfga"}], "created": "2026-06-01T20:30:17.062695+00:00", "updated": "2026-06-01T22:30:02.968317+00:00", "vendors": ["enderfga", "enderfga$PRODUCT$claw-orchestrator"]}