{"id":"CVE-2026-16124","summary":"nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery","details":"A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.","modified":"2026-07-22T05:29:51.775674202Z","published":"2026-07-18T15:00:11.635Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16124.json","unresolved_ranges":[{"extracted_events":[{"introduced":"3.15.0-beta.0"},{"last_affected":"3.15.0-beta.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/nextlevelbuilder/goclaw/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16124.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16124"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-16124"},{"type":"ADVISORY","url":"https://vuldb.com/submit/856858"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/379833"},{"type":"REPORT","url":"https://github.com/nextlevelbuilder/goclaw/issues/1218"},{"type":"REPORT","url":"https://vuldb.com/vuln/379833/cti"},{"type":"FIX","url":"https://github.com/nextlevelbuilder/goclaw/commit/12a0168271827650ddb0026d6277fbadf3dcf3ea"},{"type":"FIX","url":"https://github.com/nextlevelbuilder/goclaw/pull/1269"},{"type":"FIX","url":"https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.15.0-beta.33"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nextlevelbuilder/goclaw","events":[{"introduced":"0e994f959cd093b1ecbca3cbe13676fbff14faf5"},{"fixed":"12a0168271827650ddb0026d6277fbadf3dcf3ea"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"3.15.0-beta.1"},{"last_affected":"3.15.0-beta.1"},{"introduced":"3.15.0-beta.2"},{"last_affected":"3.15.0-beta.2"},{"introduced":"3.15.0-beta.3"},{"last_affected":"3.15.0-beta.3"},{"introduced":"3.15.0-beta.4"},{"last_affected":"3.15.0-beta.4"},{"introduced":"3.15.0-beta.5"},{"last_affected":"3.15.0-beta.5"},{"introduced":"3.15.0-beta.6"},{"last_affected":"3.15.0-beta.6"},{"introduced":"3.15.0-beta.7"},{"last_affected":"3.15.0-beta.7"},{"introduced":"3.15.0-beta.8"},{"last_affected":"3.15.0-beta.8"},{"introduced":"3.15.0-beta.9"},{"last_affected":"3.15.0-beta.9"},{"introduced":"3.15.0-beta.10"},{"last_affected":"3.15.0-beta.10"},{"introduced":"3.15.0-beta.11"},{"last_affected":"3.15.0-beta.11"},{"introduced":"3.15.0-beta.12"},{"last_affected":"3.15.0-beta.12"},{"introduced":"3.15.0-beta.13"},{"last_affected":"3.15.0-beta.13"},{"introduced":"3.15.0-beta.14"},{"last_affected":"3.15.0-beta.14"},{"introduced":"3.15.0-beta.15"},{"last_affected":"3.15.0-beta.15"},{"introduced":"3.15.0-beta.16"},{"last_affected":"3.15.0-beta.16"},{"introduced":"3.15.0-beta.17"},{"last_affected":"3.15.0-beta.17"},{"introduced":"3.15.0-beta.18"},{"last_affected":"3.15.0-beta.18"},{"introduced":"3.15.0-beta.19"},{"last_affected":"3.15.0-beta.19"},{"introduced":"3.15.0-beta.20"},{"last_affected":"3.15.0-beta.20"},{"introduced":"3.15.0-beta.21"},{"last_affected":"3.15.0-beta.21"},{"introduced":"3.15.0-beta.22"},{"last_affected":"3.15.0-beta.22"},{"introduced":"3.15.0-beta.23"},{"last_affected":"3.15.0-beta.23"},{"introduced":"3.15.0-beta.24"},{"last_affected":"3.15.0-beta.24"},{"introduced":"3.15.0-beta.25"},{"last_affected":"3.15.0-beta.25"},{"introduced":"3.15.0-beta.26"},{"last_affected":"3.15.0-beta.26"},{"introduced":"3.15.0-beta.27"},{"last_affected":"3.15.0-beta.27"},{"introduced":"3.15.0-beta.28"},{"last_affected":"3.15.0-beta.28"},{"introduced":"3.15.0-beta.29"},{"last_affected":"3.15.0-beta.29"},{"introduced":"3.15.0-beta.30"},{"last_affected":"3.15.0-beta.30"},{"introduced":"3.15.0-beta.31"},{"last_affected":"3.15.0-beta.31"},{"introduced":"3.15.0-beta.32"},{"last_affected":"3.15.0-beta.32"}]}}],"versions":["3.15.0-beta.1","3.15.0-beta.10","3.15.0-beta.11","3.15.0-beta.12","3.15.0-beta.13","3.15.0-beta.14","3.15.0-beta.15","3.15.0-beta.16","3.15.0-beta.17","3.15.0-beta.18","3.15.0-beta.19","3.15.0-beta.2","3.15.0-beta.20","3.15.0-beta.21","3.15.0-beta.22","3.15.0-beta.23","3.15.0-beta.24","3.15.0-beta.25","3.15.0-beta.26","3.15.0-beta.27","3.15.0-beta.28","3.15.0-beta.29","3.15.0-beta.3","3.15.0-beta.30","3.15.0-beta.31","3.15.0-beta.32","3.15.0-beta.4","3.15.0-beta.5","3.15.0-beta.6","3.15.0-beta.7","3.15.0-beta.8","3.15.0-beta.9","v3.15.0-beta.32","v3.15.0-beta.31","v3.15.0-beta.30","v3.15.0-beta.29","v3.15.0-beta.28","v3.15.0-beta.27","v3.15.0-beta.26","v3.15.0-beta.25","v3.15.0-beta.24","v3.15.0-beta.23","v3.15.0-beta.22","v3.15.0-beta.21","v3.15.0-beta.20","v3.15.0-beta.19","v3.15.0-beta.18","v3.15.0-beta.17","v3.15.0-beta.16","v3.15.0-beta.15","v3.15.0-beta.14","v3.15.0-beta.13","v3.15.0-beta.12","v3.15.0-beta.11","v3.15.0-beta.10","v3.15.0-beta.9","v3.15.0-beta.8","v3.15.0-beta.7","v3.15.0-beta.6","v3.15.0-beta.5","v3.15.0-beta.4","v3.15.0-beta.3","v3.15.0-beta.2","v3.15.0-beta.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16124.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}