Server-Side Request Forgery in Mosaxiv Clawlet

Executive Summary

CVE-2026-15620 is a Server-Side Request Forgery (SSRF) vulnerability in the mosaxiv clawlet software, specifically affecting versions up to 0.2.10. The issue resides in the `tools.webFetch` function within the file `tools/tool_web_fetch.go.

The vulnerability arises because the default configuration of clawlet allows all domains (using a wildcard "*") and lacks runtime checks to block requests to loopback or private network addresses, such as 127.0.0.1 or RFC1918 addresses. This means an attacker can provide a malicious URL, causing the tool to fetch internal HTTP services and return sensitive responses.

The `tools.webFetch` function only validates hostnames against the policy but does not reject private destinations. Additionally, the redirect callback fails to enforce private-network restrictions, exacerbating the issue. This allows attackers to probe internal services, access private HTTP endpoints, or use the host as a pivot for further attacks.

A proof-of-concept exploit demonstrates fetching a loopback canary server's response, confirming the defect. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-15620 vulnerability in mosaxiv clawlet (versions <= 0.2.10), you can check for the presence of the vulnerable software and test for SSRF exploitation risks.

• Verify the installed version of clawlet. If it is version 0.2.10 or earlier, it is vulnerable. You can check the version by running the command: `clawlet --version` or inspecting the binary's metadata.
• Test for SSRF by attempting to fetch internal or loopback addresses. For example, you can use a command like: `clawlet web_fetch http://127.0.0.1:80` or `clawlet web_fetch http://localhost`. If the tool returns a response from these internal addresses, the system is vulnerable.
• Monitor network traffic for unexpected outbound requests to internal or private IP ranges (e.g., 127.0.0.1, 192.168.x.x, 10.x.x.x, 172.16.x.x-172.31.x.x). Tools like Wireshark, tcpdump, or network firewalls can help detect such requests.
• Review clawlet's configuration file for the `web_fetch` tool. If the policy allows wildcard domains (*) or lacks restrictions on private network targets, the system is at risk. Look for configuration files in the default locations or check the output of `clawlet config show`.
• Check for public proof-of-concept (PoC) exploits or unusual activity in logs. For example, look for requests to clawlet's API or command-line interface that include URLs pointing to internal services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts if exploited:

• Unauthorized access to internal services: An attacker can use the SSRF vulnerability to send requests to internal systems that are not meant to be publicly accessible. This could include databases, internal APIs, or administrative interfaces.
• Data exfiltration: Sensitive data from internal services can be retrieved and sent back to the attacker. This could include confidential information, credentials, or other sensitive data.
• Network reconnaissance: Attackers can map out internal networks, identifying other vulnerable systems or services that can be targeted for further exploitation.
• Pivoting attacks: The compromised host can be used as a pivot point to launch additional attacks against other systems within the internal network.
• Service disruption: By sending requests to internal services, an attacker could potentially disrupt normal operations, leading to denial of service or other operational issues.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with various standards and regulations:

• GDPR (General Data Protection Regulation): If the SSRF vulnerability leads to unauthorized access or exfiltration of personal data, it could result in a breach of GDPR. Organizations are required to protect personal data and report breaches within 72 hours. Failure to do so can result in substantial fines and reputational damage.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), an SSRF attack that exposes PHI would constitute a HIPAA violation. This could lead to penalties, mandatory corrective action plans, and loss of trust from patients and partners.
• PCI DSS (Payment Card Industry Data Security Standard): If the vulnerable system processes or has access to payment card information, an SSRF attack could lead to unauthorized access to cardholder data. This would violate PCI DSS requirements, potentially resulting in fines, increased transaction fees, or loss of the ability to process payments.
• ISO 27001: This standard requires organizations to implement controls to manage information security risks. An SSRF vulnerability represents a failure to adequately secure systems, which could lead to non-compliance and the need for corrective actions to maintain certification.
• SOC 2: For service organizations, an SSRF vulnerability could impact the security, availability, and confidentiality principles of SOC 2. This could result in a qualified or adverse opinion in a SOC 2 audit, affecting customer trust and business relationships.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-15620, follow these immediate steps to reduce the risk of exploitation.

• Upgrade clawlet to the latest version if a patched release is available. Since the GitHub issue was closed with the label 'not planned,' check the project's repository or release notes for updates or community patches.
• Restrict access to the `web_fetch` tool. Disable or remove the tool if it is not required for your use case. This can be done by modifying the configuration file or removing the tool's binary if possible.
• Modify the clawlet configuration to enforce strict domain policies. Replace the wildcard (*) policy with an explicit allowlist of domains that the `web_fetch` tool can access. Ensure private network addresses (e.g., 127.0.0.1, RFC1918 ranges) are explicitly blocked.
• Implement network-level protections. Use firewalls or network security groups to block outbound requests from clawlet to internal or private IP ranges. This can prevent the tool from accessing unintended internal services.
• Monitor and log all requests made by the `web_fetch` tool. Enable logging for clawlet's operations and review logs regularly for suspicious activity, such as requests to internal or unexpected external domains.
• Isolate clawlet in a restricted environment. Run clawlet in a container or virtual machine with limited network access to reduce the impact of potential SSRF attacks.
• Apply compensating controls. If upgrading or reconfiguring clawlet is not immediately possible, consider using a reverse proxy or API gateway to filter and validate URLs before they reach the `web_fetch` tool.

Useful 0 Not Useful 0