Description
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
Published: 2026-07-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in GoClaw’s CheckSSRF/isPrivateIP function in internal/tools/web_shared.go, where manipulated input causes the server to fetch arbitrary URLs, enabling server‑side request forgery. This flaw is classified as CWE‑918.

Affected Systems

nextlevelbuilder’s GoClaw component, including all releases up to and including 3.15.0‑beta.32. Security is mitigated starting with the 3.15.0‑beta.33 release.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The flaw is exploitable remotely and the exploit has been publicly disclosed; it is not listed in CISA’s KEV catalog. The likely attack vector is that a remote attacker sends a specially crafted request to the GoClaw web_fetch endpoint, causing the server to perform an outbound request to a target URL of the attacker’s choosing.

Generated by OpenCVE AI on July 30, 2026 at 22:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official upstream patch (commit 12a0168271827650ddb0026d6277fbadf3dcf3ea) by upgrading to GoClaw v3.15.0‑beta.33 or later.
  • Ensure that all server‑side request functions validate target URLs against a whitelist of allowed domains or IP ranges to prevent the SSRF from reaching internal resources.
  • Audit and, if necessary, restrict network access for GoClaw services, limiting outbound traffic to only the domains required for normal operation.

Generated by OpenCVE AI on July 30, 2026 at 22:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
Title nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery
First Time appeared Nextlevelbuilder
Nextlevelbuilder goclaw
Weaknesses CWE-918
CPEs cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*
Vendors & Products Nextlevelbuilder
Nextlevelbuilder goclaw
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nextlevelbuilder Goclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T16:55:09.350Z

Reserved: 2026-07-17T15:57:06.671Z

Link: CVE-2026-16124

cve-icon Vulnrichment

Updated: 2026-07-20T16:55:05.537Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)