CVE-2026-16016

Name of the Vulnerable Software and Affected Versions poco-ai poco-claw versions prior to 0.5.5

Description A server-side request forgery (SSRF) exists in the run task() function within the file executor/app/api/v1/task.py. This issue allows a remote attacker to trigger unauthorized requests by manipulating the callback url argument. SSRF is a flaw where an attacker can force a server to make requests to an unintended location.

Recommendations Update poco-ai poco-claw to version 0.5.5 or later. As a temporary mitigation, restrict or validate the input provided to the callback url argument in the run task() function.