A flaw in the executor_manager API of poco-claw permits creating tasks without providing any authentication credentials. The missing authentication guard can enable an attacker to submit arbitrary tasks that the service executes on behalf of a privileged user, thereby potentially altering the system state, leaking data, or misusing system resources. The weakness maps to authentication bypass and missing authentication mechanisms, corresponding to CWE-287 and CWE-306.

The vulnerability affects poco-ai’s poco-claw software, specifically all versions up to and including 0.5.4. All affected installations should be upgraded to version 0.5.7 or later, which contains the address that resolves the missing authentication guard.

The CVSS score of 5.3 classifies the issue as moderate risk, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is sending an unauthenticated HTTP POST request to the create_task endpoint exposed by executor_manager/api/v1/tasks, assuming the API is reachable from the network. This remote attack path does not require elevated credentials, making the flaw simpler to leverage for malicious manipulation of the system’s task queue.