CVE-2026-16124
Full vulnerability record from the local CVENow database.
Description
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-18 16:17:12.657000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-16124",
"sourceIdentifier": "[email protected]",
"published": "2026-07-18T16:17:12.657",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended."
},
{
"lang": "es",
"value": "Una vulnerabilidad de seguridad ha sido detectada en nextlevelbuilder GoClaw hasta 3.15.0-beta.32. Esto afecta a la función CheckSSRF/isPrivateIP del archivo internal/tools/web_shared.go del componente web_fetch. Dicha manipulación conduce a falsificación de petición del lado del servidor. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado públicamente y puede ser usado. La actualización a la versión 3.15.0-beta.33 es capaz de mitigar este problema. El nombre del parche es 12a0168271827650ddb0026d6277fbadf3dcf3ea. La actualización del componente afectado es recomendada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "nextlevelbuilder",
"product": "GoClaw",
"cpes": [
"cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"web_fetch"
],
"versions": [
{
"version": "3.15.0-beta.0",
"status": "affected"
},
{
"version": "3.15.0-beta.1",
"status": "affected"
},
{
"version": "3.15.0-beta.2",
"status": "affected"
},
{
"version": "3.15.0-beta.3",
"status": "affected"
},
{
"version": "3.15.0-beta.4",
"status": "affected"
},
{
"version": "3.15.0-beta.5",
"status": "affected"
},
{
"version": "3.15.0-beta.6",
"status": "affected"
},
{
"version": "3.15.0-beta.7",
"status": "affected"
},
{
"version": "3.15.0-beta.8",
"status": "affected"
},
{
"version": "3.15.0-beta.9",
"status": "affected"
},
{
"version": "3.15.0-beta.10",
"status": "affected"
},
{
"version": "3.15.0-beta.11",
"status": "affected"
},
{
"version": "3.15.0-beta.12",
"status": "affected"
},
{
"version": "3.15.0-beta.13",
"status": "affected"
},
{
"version": "3.15.0-beta.14",
"status": "affected"
},
{
"version": "3.15.0-beta.15",
"status": "affected"
},
{
"version": "3.15.0-beta.16",
"status": "affected"
},
{
"version": "3.15.0-beta.17",
"status": "affected"
},
{
"version": "3.15.0-beta.18",
"status": "affected"
},
{
"version": "3.15.0-beta.19",
"status": "affected"
},
{
"version": "3.15.0-beta.20",
"status": "affected"
},
{
"version": "3.15.0-beta.21",
"status": "affected"
},
{
"version": "3.15.0-beta.22",
"status": "affected"
},
{
"version": "3.15.0-beta.23",
"status": "affected"
},
{
"version": "3.15.0-beta.24",
"status": "affected"
},
{
"version": "3.15.0-beta.25",
"status": "affected"
},
{
"version": "3.15.0-beta.26",
"status": "affected"
},
{
"version": "3.15.0-beta.27",
"status": "affected"
},
{
"version": "3.15.0-beta.28",
"status": "affected"
},
{
"version": "3.15.0-beta.29",
"status": "affected"
},
{
"version": "3.15.0-beta.30",
"status": "affected"
},
{
"version": "3.15.0-beta.31",
"status": "affected"
},
{
"version": "3.15.0-beta.32",
"status": "affected"
},
{
"version": "3.15.0-beta.33",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-20T16:54:36.331473Z",
"id": "CVE-2026-16124",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://github.com/nextlevelbuilder/goclaw/",
"source": "[email protected]"
},
{
"url": "https://github.com/nextlevelbuilder/goclaw/commit/12a0168271827650ddb0026d6277fbadf3dcf3ea",
"source": "[email protected]"
},
{
"url": "https://github.com/nextlevelbuilder/goclaw/issues/1218",
"source": "[email protected]"
},
{
"url": "https://github.com/nextlevelbuilder/goclaw/pull/1269",
"source": "[email protected]"
},
{
"url": "https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.15.0-beta.33",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-16124",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/856858",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/379833",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/379833/cti",
"source": "[email protected]"
}
]
}