CVE-2026-16016
HighCVSS 7.3Summary
A server-side request forgery (SSRF) vulnerability was found in poco-ai poco-claw up to version 0.5.4. The issue affects the run_task function in the executor/app/api/v1/task.py file, where the callback_url argument can be manipulated by an attacker. The attack can be carried out remotely, and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources, which could lead to data leakage or further escalation of the attack within the infrastructure.
Recommendation
Immediately update the poco-ai poco-claw library to a version newer than 0.5.4 if available, or apply temporary mitigations such as validating and filtering URLs in the callback_url parameter.
Other vulnerabilities in poco-ai poco-claw
Original NVD description (English source)
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.