CVE-2026-10281

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.

• CWE-287
• CWE-306

• https://github.com/Enderfga/claw-orchestrator/
• https://github.com/Enderfga/claw-orchestrator/commit/d0b02a800aa0689d9428cc4cc170e0b6589fb2c3
• https://github.com/Enderfga/claw-orchestrator/issues/61
• https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.5.6
• https://vuldb.com/cve/CVE-2026-10281
• https://vuldb.com/submit/825429
• https://vuldb.com/vuln/367574
• https://vuldb.com/vuln/367574/cti

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102804A vulnerability was detected in Nothings stb up to 2c980bb59…6.5
• CVE-2026-102805A flaw has been found in Nothings stb up to 1.16. This affec…6.5
• CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3
• CVE-2026-102807OpenClaw before 2026.9.4 contains an incorrect authorization…5.3
• CVE-2026-102808PX4 Autopilot through 1.17.0 contains a NULL pointer derefer…6.5
• CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5
• CVE-2026-102810Marmite through 0.4.2 contains a path traversal vulnerabilit…7.5
• CVE-2026-102811Marmite through 0.4.2 contains missing authentication in the…7.5
• CVE-2026-102812A hard-coded cryptographic key vulnerability exists in the u…6.9
• CVE-2026-102813An authentication flaw exists in the password-recovery funct…6.1
• CVE-2026-102814An authentication weakness exists in the TP-Link TDDP v2 ser…8.7
• CVE-2026-102815An operating-system command injection vulnerability exists i…6.9