CVE-2026-10583

Name of the Vulnerable Software and Affected Versions GoClaw versions prior to 3.11.4

Description A server-side request forgery (SSRF) exists in the TTS Configuration Endpoint. This issue occurs within the Import() function of the internal/http/tts config.go file, allowing a remote attacker to manipulate requests. SSRF is a flaw where an attacker can force a server to make requests to an unintended location.

Recommendations Update to version 3.11.4 or later. As a temporary workaround, restrict access to the Import() function within the TTS Configuration Endpoint.