VulnSocial

CVE-2026-32231Disclosure(zeptoclaw / zeptoclaw)

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.

zeptoclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-306CWE-345

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • zeptoclaw

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
zeptoclaw
Products
zeptoclaw

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-12: 2Technical Details · 2026-03-12: 203-12
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-32231 ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and a… https://www.cve.org/CVERecord?id=CVE-2026-32231

    Post summary

    The CVE-2026-32231 disclosure reveals that ZeptoClaw versions before 0.7.6 improperly trust caller‑supplied identity fields in webhook requests, potentially enabling impersonation; no PoC, exploit code, or patch details are provided.

    00000130
    56.7K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-32231 - High ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization chec... https://www.thehackerwire.com/vulnerability/CVE-2026-32231/ https://t.co/WE8cWgYJs6

    Post summary

    ZeptoClaw personal AI assistant prior to version 0.7.6 had a high severity flaw where caller-supplied identity fields were trusted in generic webhook channels, potentially allowing unauthorized access. No PoC, exploit code, active exploitation, or patch details are provided in the tweet.

    0000026
    134 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appzeptoclawzeptoclaw-rust-

Explore more

Back to dashboardzeptoclaw CVEszeptoclaw vulnerabilities