CVE-2026-18038 nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure
Remote attackers can exploit the jq Handler in GoClaw to disclose sensitive information, requiring a patch to mitigate the risk.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18038?
CVE-2026-18038 is a medium-severity vulnerability in nextlevelbuilder GoClaw, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1230. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-18038?
How do I fix CVE-2026-18038?
No fix has been published for CVE-2026-18038 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18038 exists.
Sources
Also known as GHSA-r4xf-9fv3-cx9j.