{"uuid": "f8d09b10-3dc2-44f7-be3f-8f9afbe83024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108757", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422430182887388", "content": "CVE-2026-108757 Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108757https://hackmd.io/@haind/nexting-pinclaw-send-unauth-agent-injectionhttps://github.com/Nexting-ai/nexting/blob/a4b75f0429d3b1bf35eef68a296b2e72aa9c7483/plugin/src/core/http-router.ts#L296-L330https://github.com/Nexting-ai/nexting/blob/a4b75f0429d3b1bf35eef68a296b2e72aa9c7483/plugin/src/core/server.ts#L149https://www.npmjs.com/package/pinclawhttps://www.vulncheck.com/advisories/nexting-pinclaw-through-0.3.0-missing-authentication-via-post-pinclaw-send#Nexting #pinclaw#CVE_2026_108757#bot", "creation_timestamp": "2026-10-11T13:08:13.959710Z"}