EUVD-2026-33879
GHSA-376c-9hgg-2xx6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. Affected by this issue is the function Import of the file internal/http/tts_config.go of the component TTS Configuration Endpoint. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
AnalysisAI
Server-side request forgery in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers with high-privilege credentials to manipulate the TTS Configuration Import function into issuing arbitrary server-side HTTP requests to unintended destinations. The vulnerable code path is the Import function within internal/http/tts_config.go, reachable over the network without user interaction once an administrative session is established. A publicly available proof-of-concept exploit exists (confirmed by CVSS temporal metric E:P and GitHub issue #1132); no active exploitation has been confirmed by CISA KEV, and the project has characterized the report as a bug rather than a security issue, which may signal a slower remediation response.
Technical ContextAI
GoClaw is a Go-based application developed by nextlevelbuilder (CPE: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*). The root cause is CWE-918 (Server-Side Request Forgery): the application's Import handler within the TTS Configuration endpoint accepts attacker-controlled input - likely a URL or resource reference - and uses it to initiate outbound server-side HTTP requests without adequate destination validation. In Go-based web services, SSRF commonly arises when http.Get() or similar net/http calls are made with user-supplied URL parameters that bypass hostname or scheme restrictions. The TTS (text-to-speech) configuration import function likely fetches an external configuration resource, making it a natural SSRF sink. A parallel disclosure at https://github.com/digitopvn/goclaw/issues/30 suggests a forked or shared codebase may also be affected, broadening the potential impact surface.
RemediationAI
No vendor-released patch has been confirmed at time of analysis (CVSS temporal RL:X - remediation level unknown). Security teams should actively monitor the GoClaw GitHub repository at https://github.com/nextlevelbuilder/goclaw/ and track issue #1132 for any patch release or maintainer response. As an immediate compensating control, restrict access to the TTS Configuration Import endpoint at the application or network layer - apply role-based access controls to limit which accounts can invoke the Import function, reducing the exposed high-privilege user population. Separately, implement an outbound egress allowlist on the GoClaw server host to restrict server-initiated HTTP connections to only pre-approved external and internal destinations; this directly neutralizes SSRF impact by preventing requests to sensitive targets such as cloud instance metadata services (169.254.169.254) or internal APIs. Note that egress filtering may break legitimate TTS configuration import workflows if the approved destination list is too narrow. If the TTS Configuration Import feature is not actively used in production, consider disabling or removing the endpoint entirely until a patch is available, as this eliminates the attack surface with no operational trade-off in non-TTS deployments.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today