CVE-2026-15624: GoClaw SSRF Vulnerability Explained

CVE-2026-15624 Overview

CVE-2026-15624 is a Server-Side Request Forgery (SSRF) vulnerability affecting nextlevelbuilder GoClaw version 3.13.3-beta.3. The flaw resides in the bytePlusDownloadVideo function within internal/tools/create_video_byteplus.go, part of the invoke Endpoint component. Attackers can manipulate the output.video_url argument to coerce the server into issuing arbitrary outbound HTTP requests. Remote exploitation is possible with low privileges, and public disclosure of the exploit technique has occurred. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Remote authenticated attackers can abuse the video download function to force the GoClaw server to issue arbitrary HTTP requests, potentially reaching internal services or metadata endpoints.

Affected Products

nextlevelbuilder GoClaw 3.13.3-beta.3
Component: invoke Endpoint
Affected function: bytePlusDownloadVideo in internal/tools/create_video_byteplus.go

Discovery Timeline

2026-07-14 - CVE-2026-15624 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15624

Vulnerability Analysis

The vulnerability exists in the GoClaw video creation subsystem. The bytePlusDownloadVideo function accepts a user-influenced output.video_url value and dispatches an HTTP request to the supplied URL without adequate validation of scheme, host, or destination.

Because the request originates from the GoClaw server, an attacker can direct it toward resources not otherwise reachable from the internet. This includes internal services, loopback endpoints, and cloud metadata APIs. The EPSS probability is 0.209%, reflecting current publicly observed exploitation likelihood rather than technical difficulty.

Root Cause

The root cause is missing allowlist enforcement on URLs consumed by bytePlusDownloadVideo. The function trusts the output.video_url parameter and issues a server-side fetch. There is no destination filtering to block private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), or loopback targets.

Attack Vector

An attacker with low-privilege access to the invoke Endpoint submits a crafted request in which output.video_url points to an internal resource. The GoClaw backend performs the fetch on behalf of the attacker and may return response content or side-channel signals such as timing and status codes.

Typical SSRF abuse targets include internal administrative APIs, unauthenticated debug endpoints, and cloud metadata services such as http://169.254.169.254/. Because the exploit is disclosed publicly, weaponization requires minimal effort. See the GitHub issue #1199 and VulDB CVE-2026-15624 details for reference material.

// No verified proof-of-concept code has been published.
// Refer to the vendor issue tracker for reproduction details.

Detection Methods for CVE-2026-15624

Indicators of Compromise

Outbound HTTP requests from the GoClaw server process to private IP ranges (RFC1918) or link-local addresses.
Requests from GoClaw to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Repeated invocations of the invoke Endpoint containing unusual output.video_url values pointing to non-BytePlus hosts.

Detection Strategies

Inspect GoClaw application logs for calls to bytePlusDownloadVideo where output.video_url does not resolve to expected BytePlus CDN domains.
Correlate authenticated user activity on the invoke Endpoint with unexpected egress connections from the GoClaw host.
Deploy egress network monitoring to flag server-originated connections to internal subnets, localhost, or metadata services.

Monitoring Recommendations

Enable structured logging of all URL parameters passed to server-side fetch functions and forward them to a central log platform.
Alert on non-2xx responses to internal targets from the GoClaw process, which often indicate SSRF probing.
Baseline normal outbound destinations for GoClaw and alert on deviations.

How to Mitigate CVE-2026-15624

Immediate Actions Required

Restrict access to the invoke Endpoint to trusted authenticated users only.
Place the GoClaw server behind an egress proxy that denies traffic to internal networks and metadata services.
Audit recent invocations of bytePlusDownloadVideo for suspicious output.video_url values.

Patch Information

At time of publication, no fixed release is referenced in the NVD entry. Monitor the GoClaw GitHub repository and issue #1199 for a maintainer response and upgrade to a patched build once available.

Workarounds

Implement an application-layer allowlist restricting output.video_url to known BytePlus domains before the fetch executes.
Block outbound traffic from the GoClaw host to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges at the network layer.
Require IMDSv2 or equivalent hardened metadata access if GoClaw runs in a cloud environment.
Disable or gate the invoke Endpoint if the BytePlus video download feature is not in use.

bash

# Example iptables rules to block SSRF-relevant destinations from the GoClaw host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT