Nullclaw vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nullclaw products: 1 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-110616 High · 8.1 CWE-306 Oct 14, 2026

NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.