CVE-2026-15620
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources and potential data leaks, as an attacker can send requests on behalf of the server.
Recommendation
Immediately update the mosaxiv clawlet library to a version newer than 0.2.10 or apply temporary mitigations such as URL filtering and restricting access to the webFetch function.
Other vulnerabilities in mosaxiv clawlet
See all- CVE-2026-16017Medium
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the list/remove function in tools/tool_cron.go of the cron Chat Tool component. Missing authorization allows remote manipulation. The exploit is public, and the GitHub issue was closed as 'not planned'.
- CVE-2026-15621Medium
A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.
- CVE-2026-15619Medium
A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.
- CVE-2026-15618Medium
A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.
Original NVD description (English source)
A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/tool_web_fetch.go. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed with the label "not planned".