CVE-2026-15619
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.
Risk Assessment
The organization is at risk of unauthorized access to internal systems and data, potentially leading to privilege escalation or information disclosure. Since the exploit is publicly available, the risk of active exploitation is high.
Recommendation
Immediately update mosaxiv clawlet to a version newer than 0.2.10 if available, or apply temporary mitigations such as URL filtering and restricting access to the web_fetch function. Given that the issue was closed with the label 'not planned', consider migrating to an alternative solution.
Other vulnerabilities in mosaxiv clawlet
See all- CVE-2026-16017Medium
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the list/remove function in tools/tool_cron.go of the cron Chat Tool component. Missing authorization allows remote manipulation. The exploit is public, and the GitHub issue was closed as 'not planned'.
- CVE-2026-15621Medium
A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.
- CVE-2026-15620Medium
A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-15618Medium
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.
Original NVD description (English source)
A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the file tools/tool_web_fetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the label "not planned".