Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H N L N L L L 1.3 .0020 10.1 —
AFFECTED Product Versions Fixed droidclaw 0.5.0 – —
TIMELINE Jul 27 Reserved by VulDB Jul 27 Published (CNA: VulDB) Jul 28 EXPLOIT PUBLISHED — CVE-2026-17531 (unitedbyai droidclaw). Public exploit reference added.
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
| Date | Event | Detail |
|---|---|---|
| July 27, 2026 | Reserved | Reserved by VulDB |
| July 27, 2026 | Published | Published (CNA: VulDB) |
| July 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-17531 (unitedbyai droidclaw). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| unitedbyai | droidclaw | — | 0.5.0 | — |
Authoritative record: CVE-2026-17531 at cve.org
Vendors: unitedbyai
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-17531 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.