CVE-2026-10281 Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication
Remote attackers can access the EmbeddedServer API endpoint without authentication due to missing checks in the claw-orchestrator library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10281?
CVE-2026-10281 is a medium-severity missing authorization vulnerability in Enderfga claw-orchestrator, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.
Which versions are affected by CVE-2026-10281?
2 open source packages ship an affected version, including @enderfga/claw-orchestrator.
| Package | Affected | Fixed in |
|---|---|---|
@enderfga/claw-orchestrator npm | All versions | 3.5.6 |
@enderfga/claw-orchestrator npm | All versions | 3.5.6 |
How do I fix CVE-2026-10281?
Upgrade @enderfga/claw-orchestrator to 3.5.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-10281 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10281 exists.
Sources
Also known as GHSA-q6qc-xp4q-rjq5.