CVE-2026-16016 Overview
CVE-2026-16016 is a server-side request forgery (SSRF) vulnerability in poco-ai poco-claw versions up to 0.5.4. The flaw resides in the run_task function within executor/app/api/v1/task.py, where the callback_url argument is not properly validated. Remote attackers can manipulate this parameter to force the application to issue arbitrary HTTP requests to attacker-controlled or internal destinations. The vulnerability is classified under [CWE-918] and is publicly disclosed with an exploit reported to be available. The associated GitHub issue was closed automatically due to inactivity, leaving affected deployments without a coordinated vendor fix.
Critical Impact
Remote, unauthenticated attackers can coerce the poco-claw executor into sending crafted requests to internal services, enabling reconnaissance of internal networks and potential access to metadata endpoints.
Affected Products
- poco-ai poco-claw versions up to and including 0.5.4
- The executor/app/api/v1/task.py module implementing run_task
- Deployments exposing the poco-claw task execution API to untrusted networks
Discovery Timeline
- 2026-07-17 - CVE-2026-16016 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-16016
Vulnerability Analysis
The vulnerability exists in poco-claw's task execution API, specifically the run_task handler in executor/app/api/v1/task.py. This endpoint accepts a callback_url parameter that the executor later invokes to report task status or results. Because the parameter is not restricted to an allow-list of trusted destinations, attackers can supply arbitrary URLs. The server then issues outbound requests to those targets on behalf of the attacker.
SSRF vulnerabilities in AI orchestration and task-runner services carry elevated risk. These services often run in cloud environments where internal endpoints expose sensitive metadata, such as instance credential endpoints on AWS, GCP, and Azure. Attackers commonly leverage SSRF to reach these endpoints and harvest short-lived cloud credentials.
Root Cause
The root cause is missing input validation on the callback_url argument. The run_task function trusts caller-supplied URLs without enforcing scheme restrictions, host allow-listing, or blocking of private and link-local address ranges. This maps directly to [CWE-918]: Server-Side Request Forgery.
Attack Vector
An attacker submits a task creation request to the executor API and sets callback_url to a target of their choice. When the executor processes the task, it issues an HTTP request to the supplied URL. Targets can include loopback services, container orchestration APIs, cloud metadata endpoints, or internal microservices that trust requests originating from the executor host. No authentication is required, and the attack is fully remote over the network.
See the poco-claw GitHub repository and GitHub Issue #138 for the reported technical context.
Detection Methods for CVE-2026-16016
Indicators of Compromise
- Outbound HTTP requests from the poco-claw executor host to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that are not part of normal task callback traffic.
- Requests to /api/v1/task containing callback_url values pointing to non-standard schemes such as file://, gopher://, or dict://.
- Unexpected DNS lookups from the executor process for attacker-controlled domains embedded in callback_url parameters.
Detection Strategies
- Inspect application and reverse-proxy logs for run_task invocations and correlate the callback_url values with subsequent outbound connections from the executor.
- Deploy egress filtering telemetry to identify executor-originated traffic that bypasses expected callback destinations.
- Add web application firewall (WAF) rules that flag callback_url values resolving to private, loopback, or metadata IP ranges.
Monitoring Recommendations
- Monitor for anomalous outbound HTTP requests from containers or hosts running poco-claw, especially to cloud metadata IPs.
- Alert on repeated task submissions from a single source with varying callback_url hostnames, which suggests SSRF probing.
- Track process-level network telemetry for the executor service and baseline its normal callback destinations.
How to Mitigate CVE-2026-16016
Immediate Actions Required
- Restrict network access to the poco-claw executor API so that only trusted internal clients can submit tasks.
- Apply egress firewall rules that block the executor from reaching cloud metadata endpoints and internal management interfaces.
- Audit historical task submissions for suspicious callback_url values pointing to internal or link-local addresses.
Patch Information
No official patch is referenced in the advisory. The linked GitHub Issue #138 was closed automatically due to inactivity. Operators should track the poco-claw repository for a fixed release beyond 0.5.4 and, in the interim, apply compensating controls. Additional advisory context is available at VulDB CVE-2026-16016.
Workarounds
- Introduce a reverse proxy in front of the executor that validates callback_url against an allow-list of approved callback hosts and schemes.
- Force the executor to run with an outbound network policy that denies traffic to 127.0.0.0/8, 169.254.0.0/16, and RFC1918 ranges unless explicitly required.
- Require authentication and rate limiting on the run_task endpoint to reduce the ability of unauthenticated attackers to enumerate internal targets.
# Example egress restriction using iptables to block metadata and loopback access
# from the poco-claw executor container's network namespace
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner pocoexec -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner pocoexec -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner pocoexec -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
