CVE-2026-10583 Overview
CVE-2026-10583 is a server-side request forgery (SSRF) vulnerability affecting nextlevelbuilder GoClaw through version 3.11.3. The flaw resides in the Import function within internal/http/tts_config.go, part of the TTS Configuration Endpoint component. An authenticated remote attacker can manipulate input to coerce the server into issuing arbitrary outbound requests. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The project maintainers have tagged the report as a bug. This issue is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can leverage the GoClaw TTS Configuration Import function to make the server send crafted HTTP requests to attacker-controlled or internal destinations, enabling reconnaissance of internal services and potential data exposure.
Affected Products
- nextlevelbuilder GoClaw versions up to and including 3.11.3
- Component: TTS Configuration Endpoint (internal/http/tts_config.go)
- Affected function: Import
Discovery Timeline
- 2026-06-02 - CVE-2026-10583 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10583
Vulnerability Analysis
The vulnerability exists in the Import function of internal/http/tts_config.go, which handles configuration imports for the text-to-speech (TTS) subsystem. The function accepts user-controlled input that influences the destination of outbound HTTP requests issued by the GoClaw service. Because the URL or host parameter is not sufficiently validated, an attacker can supply arbitrary endpoints, including internal-only addresses, cloud metadata services, or loopback interfaces. The exploit requires high privileges according to the published CVSS 4.0 vector, but it can be triggered remotely over the network without user interaction.
Root Cause
The root cause is missing or insufficient validation of destination URLs supplied to the Import handler. Server-side request forgery [CWE-918] occurs when an application fetches a remote resource without restricting the user-supplied target to an allowlist of safe hosts. In GoClaw, the TTS configuration import path issues outbound requests on behalf of the server using attacker-influenced parameters.
Attack Vector
An authenticated user with sufficient privileges sends a request to the TTS Configuration Endpoint containing a manipulated import target. The GoClaw server then performs an outbound HTTP request to the specified location. Attackers can use this primitive to probe internal network ranges, reach unauthenticated internal services, or attempt to read cloud instance metadata. The vulnerability mechanism is described in the VulDB advisory and the GitHub issue tracker. No verified proof-of-concept code is published; refer to the upstream references for technical details.
Detection Methods for CVE-2026-10583
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the GoClaw process to internal IP ranges (RFC1918), loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Access log entries showing calls to the TTS configuration import route with externally controlled URL parameters.
- Unusual DNS lookups from the GoClaw host targeting attacker-controlled domains following authenticated API activity.
Detection Strategies
- Inspect application logs for invocations of the Import handler in internal/http/tts_config.go and correlate with the source IP and authenticated identity.
- Deploy egress monitoring on the GoClaw host to flag outbound connections to non-allowlisted destinations.
- Apply web application firewall rules that block import requests containing internal IP literals, link-local addresses, or non-HTTPS schemes.
Monitoring Recommendations
- Forward GoClaw access and error logs to a centralized SIEM for correlation with network telemetry.
- Alert on authenticated sessions issuing repeated TTS configuration imports within short time windows.
- Track outbound traffic baselines from the GoClaw service and alert on deviations to new external hosts.
How to Mitigate CVE-2026-10583
Immediate Actions Required
- Restrict network access to the GoClaw TTS Configuration Endpoint so it is reachable only by trusted administrative users.
- Audit accounts with privileges high enough to invoke the Import function and revoke unnecessary access.
- Place the GoClaw host behind egress controls that block requests to internal networks and cloud metadata endpoints.
Patch Information
At the time of publication, no fixed version has been identified in the NVD record for GoClaw. Monitor the GoClaw GitHub repository and the related issue for an official patch. Review the VulDB CVE entry for ongoing updates.
Workarounds
- Disable or remove the TTS configuration import feature if it is not required for production operations.
- Enforce an allowlist of permitted destination hosts at the application or proxy layer for any outbound requests initiated by GoClaw.
- Route outbound HTTP traffic from GoClaw through a forwarding proxy that strips or rejects requests to private address spaces.
# Example egress restriction using iptables to block GoClaw from reaching internal ranges and cloud metadata
iptables -A OUTPUT -m owner --uid-owner goclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner goclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner goclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner goclaw -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
