EUVD-2026-45385
GHSA-ggmr-9v2r-pqw6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring low-privilege authentication (PR:L); scope unchanged; Low C/I/A reflects constrained reach limited to internal services on non-standard IP ranges.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
AnalysisAI
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF blocklist in the web_fetch component by targeting IP addresses in the RFC 2544 benchmarking range (198.18.0.0/15) and the reserved-for-future-use range (240.0.0.0/4), which the isPrivateIP function in internal/tools/web_shared.go failed to block. A publicly available proof-of-concept exploit exists (GitHub issue #1218, corroborated by E:P in the CVSS 4.0 vector), though no CISA KEV entry confirms active widespread exploitation. The bypass is constrained by a PR:L requirement and by the rarity of infrastructure that routes these non-standard ranges to reachable internal services.
Technical ContextAI
GoClaw (cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*) is a Go-based web application exposing a web_fetch feature that issues server-side HTTP requests to user-supplied URLs. To prevent SSRF (CWE-918), it maintains a blocklist of private and reserved IP ranges split across internal/tools/web_shared.go (isPrivateIP) and internal/security/ssrf.go (CheckSSRF). The pre-patch blocklist covered RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16, including cloud metadata at 169.254.169.254), and carrier-grade NAT (100.64.0.0/10, RFC 6598), but omitted RFC 2544 benchmarking space (198.18.0.0/15) and the IANA reserved block (240.0.0.0/4). The patch at commit 12a0168271827650ddb0026d6277fbadf3dcf3eb adds these two ranges to both files and introduces regression tests covering them, confirming the omission was the sole root cause.
RemediationAI
Upgrade GoClaw to version 3.15.0-beta.33 (vendor-released patch), which adds the RFC 2544 benchmarking range (198.18.0.0/15) and the IANA reserved block (240.0.0.0/4) to the SSRF blocklist in both internal/tools/web_shared.go and internal/security/ssrf.go. The release is available at https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.15.0-beta.33. If immediate upgrade is not feasible, apply a network-level egress filter on the GoClaw server host to block outbound connections to 198.18.0.0/15 and 240.0.0.0/4 - these ranges have no legitimate public internet use and dropping them causes no operational side effects. As a secondary measure, restrict access to the web_fetch feature to the smallest possible set of trusted accounts, since PR:L means any valid user can currently exploit this; this reduces exposure but does not eliminate the flaw.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today