CVE-2026-112251: antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope?
Deployments of antoinersx clawhost up to version 0.0.45 that use the Reverse Proxy component are affected.
What access does an attacker need?
The issue can be initiated remotely and does not require privileges. The CVSS vector indicates user interaction is required.
How urgent is triage?
A public exploit is available, which increases the likelihood of attempted exploitation. The reported severity is medium, with a CVSS score of 4.3.
Is a vendor fix or response confirmed?
No vendor response is reported. The available information does not identify a fixed version or a vendor-provided mitigation.