CVE-2026-15620

Name of the Vulnerable Software and Affected Versions mosaxiv clawlet versions prior to 0.2.11

Description A remote server-side request forgery (SSRF) exists in the tools.webFetch() function within the tools/tool web fetch.go file. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the tools.webFetch() function to minimize the risk of exploitation.