Server-Side Request Forgery in GoClaw 3.13.3-beta.3

Executive Summary

CVE-2026-15624 is a Server-Side Request Forgery (SSRF) vulnerability in the nextlevelbuilder GoClaw software, specifically affecting version 3.13.3-beta.3. The vulnerability occurs in the function bytePlusDownloadVideo within the file internal/tools/create_video_byteplus.go.

The issue arises when the software processes the argument output.video_url in the invoke endpoint. The software trusts video URLs returned by upstream providers without applying existing SSRF protections. An authenticated operator can exploit this by triggering a video-generation workflow via a POST request to /v1/tools/invoke. If a malicious provider returns a crafted video URL, the server will fetch it directly using a plain HTTP client, bypassing SSRF-safe validation and pinned-IP dialing used elsewhere in the project.

This vulnerability allows an attacker to access internal network resources, such as admin panels or metadata endpoints, which are not publicly accessible. The vulnerability affects multiple provider implementations, including BytePlus, Gemini, and MiniMax, all of which download provider-returned URLs without proper SSRF checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can look for signs of Server-Side Request Forgery (SSRF) exploitation in the GoClaw application logs. Specifically, check for requests to internal or unexpected IP addresses (e.g., 127.0.0.1, private network ranges) originating from the `create_video` tool.

• Review GoClaw logs for HTTP requests made by the `bytePlusDownloadVideo` function in `internal/tools/create_video_byteplus.go`. Look for unusual or internal URLs in the `output.video_url` argument.
• Use network monitoring tools to inspect outbound traffic from the GoClaw server. Look for requests to internal IP addresses or unexpected domains that may indicate SSRF exploitation.
• Check for unauthorized access to internal services or admin panels by reviewing logs of those services for requests originating from the GoClaw server's IP address.

Example commands to inspect logs (adjust paths as needed):

• grep -r "bytePlusDownloadVideo" /var/log/goclaw/ | grep -E "127\.0\.0\.1|192\.168|10\.|172\.(1[6-9]|2[0-9]|3[0-1])"
• journalctl -u goclaw --since "1 hour ago" | grep -i "output.video_url"
• tcpdump -i eth0 -n "host not <expected_external_provider> and (dst net 10 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16 or dst host 127.0.0.1)"

Useful 0 Not Useful 0

Impact Analysis

If you are using the affected version of GoClaw (3.13.3-beta.3), this vulnerability could have several impacts:

• Unauthorized internal network access: An attacker could exploit this vulnerability to access non-public internal resources, such as admin panels, metadata endpoints, or other sensitive systems within your network.
• Data exposure: The vulnerability could lead to the exposure of sensitive data stored on internal systems that are not meant to be publicly accessible.
• Potential for further attacks: Once an attacker gains access to internal resources, they may use this foothold to launch additional attacks, escalate privileges, or move laterally within your network.

The vulnerability requires an authenticated operator to exploit, meaning the attacker would need valid credentials to trigger the video-generation workflow. However, once exploited, the impact can be significant due to the potential for internal network access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with several common standards and regulations, depending on the nature of the data and systems involved:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access to personal data of EU citizens, it could result in a data breach under GDPR. Organizations are required to implement appropriate security measures to protect personal data, and failure to do so could lead to significant fines and legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected system handles protected health information (PHI), unauthorized access to such data due to this vulnerability could constitute a HIPAA violation. Covered entities and business associates must ensure the confidentiality, integrity, and availability of PHI, and breaches can result in penalties.
• Other standards: Depending on the industry, this vulnerability could also affect compliance with standards like PCI DSS (Payment Card Industry Data Security Standard) if payment card data is exposed, or SOC 2 (Service Organization Control 2) if the organization is required to demonstrate secure handling of customer data.

Organizations using the affected software should assess the potential impact on their compliance obligations and take steps to mitigate the vulnerability to avoid regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade GoClaw to the latest version if a patch is available. Monitor the project's GitHub repository for updates addressing CVE-2026-15624.
• If upgrading is not immediately possible, apply temporary mitigations by restricting access to the `/v1/tools/invoke` endpoint. Use network-level controls (e.g., firewalls) to limit access to trusted operators only.
• Implement SSRF protections for the `create_video` tool by validating and sanitizing the `output.video_url` argument. Ensure all outbound requests from this function use the same SSRF-safe validation and pinned-IP dialing as the `web_fetch` tool.
• Disable or restrict access to the `create_video` tool if it is not critical to your workflow. This can be done by modifying the GoClaw configuration or removing the tool from the agent pipeline.
• Monitor the GoClaw server for suspicious outbound requests, particularly those targeting internal IP addresses or unexpected domains. Use network monitoring tools to alert on such activity.
• Review and audit the provider implementations (BytePlus, Gemini, MiniMax) to ensure they do not return malicious or internal URLs. Consider whitelisting trusted domains for video URLs.
• Restrict the permissions of the GoClaw service account to minimize potential damage if the vulnerability is exploited. Follow the principle of least privilege.

Useful 0 Not Useful 0