nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextlevelbuilder | GoClaw | 3.15.0-beta.0; 3.15.0-beta.1; 3.15.0-beta.2; 3.15.0-beta.3; 3.15.0-beta.4; 3.15.0-beta.5; 3.15.0-beta.6; 3.15.0-beta.7; 3.15.0-beta.8; 3.15.0-beta.9; 3.15.0-beta.10; 3.15.0-beta.11; 3.15.0-beta.12; 3.15.0-beta.13; 3.15.0-beta.14; 3.15.0-beta.15; 3.15.0-beta.16; 3.15.0-beta.17; 3.15.0-beta.18; 3.15.0-beta.19; 3.15.0-beta.20; 3.15.0-beta.21; 3.15.0-beta.22; 3.15.0-beta.23; 3.15.0-beta.24; 3.15.0-beta.25; 3.15.0-beta.26; 3.15.0-beta.27; 3.15.0-beta.28; 3.15.0-beta.29; 3.15.0-beta.30; 3.15.0-beta.31; 3.15.0-beta.32 | 3.15.0-beta.33 | Patch available | CNA |
- GoClaw Vendornextlevelbuilder Affected 3.15.0-beta.0; 3.15.0-beta.1; 3.15.0-beta.2; 3.15.0-beta.3; 3.15.0-beta.4; 3.15.0-beta.5; 3.15.0-beta.6; 3.15.0-beta.7; 3.15.0-beta.8; 3.15.0-beta.9; 3.15.0-beta.10; 3.15.0-beta.11; 3.15.0-beta.12; 3.15.0-beta.13; 3.15.0-beta.14; 3.15.0-beta.15; 3.15.0-beta.16; 3.15.0-beta.17; 3.15.0-beta.18; 3.15.0-beta.19; 3.15.0-beta.20; 3.15.0-beta.21; 3.15.0-beta.22; 3.15.0-beta.23; 3.15.0-beta.24; 3.15.0-beta.25; 3.15.0-beta.26; 3.15.0-beta.27; 3.15.0-beta.28; 3.15.0-beta.29; 3.15.0-beta.30; 3.15.0-beta.31; 3.15.0-beta.32 Fixed in 3.15.0-beta.33 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* | — | — | nextlevelbuilder |
- cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* Versions — — ·nextlevelbuilder
Remediation
- Fix · CNA GoClaw (nextlevelbuilder) Fixed in 3.15.0-beta.33
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16124
- 2026-10-03 Alias added: GHSA-ggmr-9v2r-pqw6
References
Patch 3
More nextlevelbuilder vulnerabilities
- TI-2026-09124 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication CVSS 4.0MEDIUM 6.9
- TI-2026-08957 nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection CVSS 4.0MEDIUM 6.9
- TI-2026-14855 nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure CVSS 4.0MEDIUM 5.3
- TI-2026-13540 nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization CVSS 4.0MEDIUM 5.3
- TI-2026-13493 nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization CVSS 4.0MEDIUM 5.3
- TI-2026-13491 nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-16124 · CVE Program
- CVE-2026-16124 · NVD
- FIRST EPSS
- GHSA-ggmr-9v2r-pqw6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences