GoClaw EUVD-2026-45385

Exploitation requires a valid low-privilege GoClaw account (CVSS PR:L confirmed). The web_fetch component must be accessible to the attacker's account, which is its default purpose in GoClaw. Critically, meaningful impact requires that the GoClaw server's network environment routes 198.18.0.0/15 (RFC 2544 benchmarking space) or 240.0.0.0/4 (reserved space) to internal services - this is not the default in most cloud or enterprise networks, but is possible in some carrier, lab, or custom infrastructure configurations. No special GoClaw configuration is required; the missing blocklist entries are absent from the default deployment. Exploitation is limited by: (1) the PR:L authentication requirement, (2) the non-standard nature of the bypassed IP ranges which are not routed to internal services in typical environments, and (3) the Low impact ceiling even when conditions are met.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a meaningful but constrained threat. PR:L confirms a valid low-privilege account is required, ruling out unauthenticated opportunistic exploitation. A POC is public (E:P), so the technique is documented and reproducible by any authenticated user. No CISA KEV entry exists, and the EPSS signal is unavailable in the provided data - the absence of KEV listing, combined with the non-standard nature of the bypassed IP ranges, suggests targeted rather than mass exploitation. Real-world impact depends critically on whether the GoClaw server's network environment routes 198.18.0.0/15 or 240.0.0.0/4 addresses to internal services, which is uncommon in standard cloud or enterprise deployments. Low C/I/A impact ratings (VC:L/VI:L/VA:L) are consistent with a constrained SSRF that may read or interact with reachable internal endpoints but does not grant full system compromise. Net: genuine vulnerability with a working POC, but realistic impact is bounded by authentication, non-standard IP ranges, and routing prerequisites.

An authenticated GoClaw user with a low-privilege account submits a web_fetch request targeting an internal service reachable at an address in the 198.18.0.0/15 benchmarking range - for example, http://198.18.0.1/admin/config - knowing that the SSRF blocklist omits this range. GoClaw's server-side HTTP client issues the request unchecked, and the internal service response is returned to the attacker, potentially exposing internal API data or allowing state-mutating requests. A public proof-of-concept demonstrating this bypass is available at https://github.com/nextlevelbuilder/goclaw/issues/1218.