« Volver al listado

CVE-2026-32231

Estado: AnalizadaAlta (8.2)—

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso sin autenticación a endpoint web expuesto (POST /webhook) sin validación de identidad, permitiendo suplantación de usuarios autorizados e inyección de mensajes. CWE-306 (missing auth) y CWE-345 (insuficiente verificación de origen).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser Training

Tecnologías afectadas (1)

Zeptoclaw — Zeptoclaw

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32231",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32231",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T20:44:25.972912Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "qhkm",
          "product": "zeptoclaw",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.7.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-12T19:16:17.027",
  "references": [
    {
      "url": "https://github.com/qhkm/zeptoclaw/commit/bf004a20d3687a0c1a9e052ec79536e30d6de134",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/qhkm/zeptoclaw/pull/324",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/qhkm/zeptoclaw/releases/tag/v0.7.6",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6."
    },
    {
      "lang": "es",
      "value": "ZeptoClaw es un asistente de IA personal. Antes de la 0.7.6, el canal genérico de webhook confía en los campos de identidad proporcionados por el llamante (remitente, chat_id) del cuerpo de la solicitud y aplica comprobaciones de autorización a esos valores no confiables. Dado que la autenticación es opcional y por defecto está deshabilitada (auth_token: None), un atacante que puede acceder a POST /webhook puede suplantar a un remitente en la lista de permitidos y elegir valores arbitrarios de chat_id, lo que permite la suplantación de mensajes de alto riesgo y un posible abuso de enrutamiento de sesión/chat al estilo IDOR. Esta vulnerabilidad está corregida en la 0.7.6."
    }
  ],
  "lastModified": "2026-06-17T10:35:23.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zeptoclaw:zeptoclaw:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "446CFDB7-D281-42EE-8598-22028731D511",
              "versionEndIncluding": "0.7.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}