EUVD-2026-45171

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function createtask of the file executormanager/app/api/v1/tasks.py of the component executormanager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...

CVE-2026-16015: Missing Authentication for Critical Function

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function createtask of the file executormanager/app/api/v1/tasks.py of the component executormanager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...

CVE-2026-16016: Server-Side Request Forgery (SSRF)

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

CVE-2026-15622: Authorization Bypass Through User-Controlled Key

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...