The vulnerability in Enderfga claw‑orchestrator’s EmbeddedServer component allows a remote attacker to contact the API endpoint without any authentication, due to a missing check in the embedded‑server.ts file. Because the flaw exists in all releases up to 3.5.5, a publicly available exploit can be used to perform unauthorized actions against the orchestrator platform.

The flaw affects Enderfga claw‑orchestrator for all releases up to and including 3.5.5. The official fix is supplied in version 3.5.6, which can be downloaded from the project’s release tag v3.5.6 or applied via the referenced patch commit d0b02a800aa0689d9428cc4cc170e0b6589fb2c3.

With a CVSS score of 6.9 the vulnerability is moderate‑high severity. No EPSS score is published, but the exploit has already been released to the public, indicating that attackers may attempt to leverage the weakness. Although the vulnerability is not listed in the CISA KEV catalog, it remains risky because it permits remote, unauthenticated access and could serve as a foothold for further compromise. The attack vector is clearly remote, meaning exposed instances are vulnerable without network isolation.