EUVD-2026-45172
GHSA-7w79-pf8w-rg85
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint; SSRF enables scope change affecting subsequent internal systems; no direct availability impact on the vulnerable component.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
Server-side request forgery in poco-ai/poco-claw up to version 0.5.4 allows remote unauthenticated attackers to coerce the application server into issuing arbitrary HTTP requests to attacker-controlled destinations via the unvalidated callback_url parameter in the run_task API function. The flaw is exposed through the task execution endpoint at executor/app/api/v1/task.py and carries a publicly available proof-of-concept exploit referenced on GitHub. No vendor patch has been released; the associated GitHub issue was closed automatically due to inactivity, indicating no active maintenance response and indefinite risk exposure.
Technical ContextAI
poco-claw (CPE: cpe:2.3:a:poco-ai:poco-claw:*:*:*:*:*:*:*:*) is an AI task orchestration framework by poco-ai. The vulnerability resides in the run_task function within executor/app/api/v1/task.py, where the callback_url argument supplied by API callers is passed to a server-side HTTP client without URL validation, allowlisting, or destination filtering. CWE-918 (Server-Side Request Forgery) describes this class of flaw: the application fetches a remote resource based on user-controlled input, allowing attackers to bypass network perimeter controls and reach otherwise inaccessible targets. The callback_url parameter is architecturally designed to notify an external service upon task completion, but the absence of input sanitization means any URL - including those resolving to RFC 1918 private ranges, loopback addresses, or cloud instance metadata endpoints such as the AWS IMDSv1 service at 169.254.169.254 - will be fetched by the server without restriction.
RemediationAI
No vendor-released patch has been identified at time of analysis - the originating GitHub issue (https://github.com/poco-ai/poco-claw/issues/138) was closed automatically due to inactivity, signaling no remediation commitment from the maintainer. As a primary compensating control, operators should implement a server-side allowlist restricting callback_url destinations to known, approved external endpoints, rejecting any URLs resolving to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses including cloud metadata ranges (169.254.0.0/16). Deploying network-level egress filtering on the poco-claw host to block outbound HTTP to internal network segments is an effective layered control with minimal operational side effects. If the callback feature is non-essential, disabling or removing it from the API is the most reliable mitigation. Organizations that cannot patch or disable the feature should place the service behind an authenticating reverse proxy to eliminate the unauthenticated attack surface, accepting the trade-off of increased deployment complexity.
Unauthenticated authorization bypass in poco-ai/poco-claw's Workspace API allows remote attackers to access arbitrary us
Missing authentication on the executor_manager control-plane API in poco-ai/poco-claw through version 0.5.4 allows adjac
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today