SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-16015

MEDIUM · CVSS 6.3 EPSS 0.38% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The poco-ai poco-claw versions up to 0.5.4 are vulnerable due to a flaw in the create_task function within the executor_manager API, which can lead to missing authentication. This vulnerability could be exploited to manipulate tasks without proper authorization, posing a risk to system integrity. Organizations using affected versions should prioritize upgrading to version 0.5.7 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit poc
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-16015
Severity
MEDIUM
CVSS
6.3
EPSS
0.38%

Original NVD Description

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.