Description
A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the file tools/tool_web_fetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the label "not planned".
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in the web_fetch function of tools/tool_web_fetch.go in the IPv4 Handler component allows an attacker to manipulate the URL argument and force the Clawlet server to perform arbitrary HTTP requests. This vulnerability is a classic server‑side request forgery that can be triggered remotely. The flaw is identified as CWE‑918 and an exploit has been made available publicly.

Affected Systems

The vulnerable product is mosaxiv Clawlet, all releases up to and including version 0.2.10. Earlier versions lack the fix and are therefore affected.

Risk and Exploitability

The CVSS score of 5.3 denotes moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can send crafted requests that cause the Clawlet server to contact arbitrary URLs, potentially exposing the server to unintended resources, but the description does not confirm successful exploitation beyond that capability.

Generated by OpenCVE AI on July 31, 2026 at 10:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Clawlet to a version newer than 0.2.10 that implements the SSRF fix.
  • If upgrading is not immediately feasible, disable the web_fetch functionality or restrict its usage to trusted callers only by modifying configuration or code.
  • Apply network segmentation or firewall rules to block outbound traffic from the Clawlet service to internal IP ranges, limiting the potential impact of an SSRF exploitation.

Generated by OpenCVE AI on July 31, 2026 at 10:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the file tools/tool_web_fetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the label "not planned".
Title mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
First Time appeared Mosaxiv
Mosaxiv clawlet
Weaknesses CWE-918
CPEs cpe:2.3:a:mosaxiv:clawlet:*:*:*:*:*:*:*:*
Vendors & Products Mosaxiv
Mosaxiv clawlet
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mosaxiv Clawlet
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T14:29:41.559Z

Reserved: 2026-07-13T16:57:35.760Z

Link: CVE-2026-15619

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:00:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)