PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-16015 poco-ai CVE debrief

CVE-2026-16015 is a vulnerability in poco-ai poco-claw up to 0.5.4, affecting the create_task function in executor_manager/app/api/v1/tasks.py. Exploitation may lead to missing authentication. Upgrading to version 0.5.7 or applying patch 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 resolves the issue. This vulnerability has been publicly disclosed. Users should review official advisories and verify affected deployments. Evidence is limited, and defenders should confirm whether affected product deployments exist in managed environments. The CVE record was published on 2026-07-17T14:17:21.517Z and was last modified on 2026-07-17T14:59:38.667Z.

Vendor
poco-ai
Product
poco-claw
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-17
Original CVE updated
2026-07-17
Advisory published
2026-07-17
Advisory updated
2026-07-17

Who should care

Users of poco-ai poco-claw up to version 0.5.4 should be aware of this vulnerability and take steps to upgrade to version 0.5.7 or apply the patch. Operators, platform administrators, vulnerability management teams, and security teams may be impacted.

Technical summary

The vulnerability CVE-2026-16015 was found in poco-ai poco-claw up to version 0.5.4. It affects the create_task function in executor_manager/app/api/v1/tasks.py, potentially leading to missing authentication. The issue can be resolved by upgrading to version 0.5.7, which includes patch 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Users should review and monitor executor_manager API usage, focusing on authentication mechanisms and potential bypasses. Reviewing official advisories and verifying affected deployments is crucial. Limited evidence suggests defenders should proceed with caution and verify system configurations.

Defensive priority

Low

Recommended defensive actions

  • Upgrade poco-claw to version 0.5.7 or later
  • Apply patch 67fcc88505c57f77d3fcf04eb5b89425b10cbf48
  • Review and monitor executor_manager API usage
  • Confirm whether affected product deployments exist in managed environments
  • Review compensating controls for exposed systems while remediation is scheduled
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-17T14:17:21.517Z and was last modified on 2026-07-17T14:59:38.667Z. The NVD entry is currently Deferred. The vulnerability affects poco-ai poco-claw up to version 0.5.4. Evidence is limited, and defenders should verify affected product deployments and review official advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-16015 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-16015

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-16015 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-16015

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.