nullclaw CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL nullclaw CVE published 2026-10-14

CVE-2026-110616

CVE-2026-110616 debrief based on source corpus. The vulnerability allows unauthenticated access to the /api/* management API, enabling attackers to control agent instances, rewrite configurations, and manage cron jobs and MCP servers. Defenders should assess exposure and prioritize remediation based on the critical severity of this vulnerability. The auth_token field defaults to null and is never assigned [truncated]