CVE-2026-16124: GoClaw SSRF Vulnerability

CVE-2026-16124 Overview

CVE-2026-16124 is a Server-Side Request Forgery (SSRF) vulnerability affecting nextlevelbuilder GoClaw through version 3.15.0-beta.32. The flaw resides in the CheckSSRF/isPrivateIP function within internal/tools/web_shared.go, part of the web_fetch component. The private-IP filter fails to block the RFC 2544 benchmarking range (198.18.0.0/15) and the reserved future-use range (240.0.0.0/4). Authenticated remote attackers can abuse this gap to coerce the server into contacting restricted network destinations. The exploit has been disclosed publicly. Upgrading to 3.15.0-beta.33, which includes patch 12a0168271827650ddb0026d6277fbadf3dcf3ea, resolves the issue.

Critical Impact
Authenticated attackers can bypass GoClaw's SSRF protection to reach internal network ranges that were omitted from the private-IP allowlist.

Affected Products

nextlevelbuilder GoClaw up to and including 3.15.0-beta.32
Component: web_fetch (function CheckSSRF/isPrivateIP)
File: internal/tools/web_shared.go

Discovery Timeline

2026-07-18 - CVE-2026-16124 published to NVD
2026-07-20 - Last updated in NVD database
Patch commit - 12a0168271827650ddb0026d6277fbadf3dcf3ea released in v3.15.0-beta.33

Technical Details for CVE-2026-16124

Vulnerability Analysis

GoClaw's web_fetch tool performs outbound HTTP requests on behalf of the caller. Before dispatching a request, the code resolves the target hostname and checks the resulting address against a list of private and reserved CIDR ranges in isPrivateIP. The original allowlist covered common private, loopback, link-local, multicast, and carrier-grade NAT ranges, but omitted the RFC 2544 benchmarking network (198.18.0.0/15) and the IANA reserved-for-future-use block (240.0.0.0/4). Attackers with permission to invoke web_fetch can supply URLs whose hostnames resolve into those ranges. This bypasses the SSRF guard and allows the server to issue requests to internal or otherwise sensitive endpoints. The weakness is classified as [CWE-918] Server-Side Request Forgery.

Root Cause

The root cause is an incomplete deny list in the privateRanges slice inside internal/tools/web_shared.go and the mirror list in internal/security/ssrf.go. The filter enumerated well-known private networks but did not include RFC 2544 and RFC 5735 reserved ranges. Any address parsed to those blocks was treated as public and allowed.

Attack Vector

Exploitation requires network access to the GoClaw HTTP interface and low-privilege authentication. An attacker submits a web_fetch request whose target hostname resolves to an address inside 198.18.0.0/15 or 240.0.0.0/4. The server issues the outbound request and returns response data to the attacker, enabling reconnaissance of internal services that share those ranges.

// Security patch in internal/tools/web_shared.go
		{"169.254.0.0", 16},  // link-local
		{"172.16.0.0", 12},   // private
		{"192.168.0.0", 16},  // private
-		{"100.64.0.0", 10},   // carrier-grade NAT
+		{"100.64.0.0", 10},   // carrier-grade NAT (RFC 6598)
+		{"198.18.0.0", 15},   // benchmarking (RFC 2544)
+		{"240.0.0.0", 4},     // reserved for future use
	}

	for _, r := range privateRanges {

Source: GitHub Commit 12a0168

Detection Methods for CVE-2026-16124

Indicators of Compromise

Outbound HTTP requests originating from the GoClaw process to destinations in 198.18.0.0/15 or 240.0.0.0/4.
web_fetch invocations containing target URLs whose hostnames resolve into RFC 2544 or reserved ranges.
Unexpected DNS lookups from the GoClaw host for domains that resolve to those CIDR blocks.

Detection Strategies

Inspect application logs for web_fetch calls and correlate the resolved destination IP with the reserved CIDR ranges added in the patch.
Deploy egress firewall logging on the GoClaw host and alert on traffic egressing to 198.18.0.0/15 or 240.0.0.0/4.
Compare the running GoClaw version against 3.15.0-beta.33 to identify vulnerable deployments.

Monitoring Recommendations

Enable DNS query logging on hosts running GoClaw and alert on resolutions into benchmarking or reserved ranges.
Track authenticated user activity that invokes web_fetch and flag high-volume or scripted usage patterns.
Forward GoClaw application logs and network telemetry to a centralized analytics platform to enable cross-source correlation.

How to Mitigate CVE-2026-16124

Immediate Actions Required

Upgrade GoClaw to v3.15.0-beta.33 or later, which contains commit 12a0168271827650ddb0026d6277fbadf3dcf3ea.
Restrict access to the GoClaw API to trusted authenticated users while the upgrade is planned.
Audit historical web_fetch logs for requests targeting 198.18.0.0/15 or 240.0.0.0/4.

Patch Information

The fix is delivered in GoClaw release v3.15.0-beta.33 via pull request #1269. It extends the private-IP deny list in internal/security/ssrf.go and internal/tools/web_shared.go to include 198.18.0.0/15 and 240.0.0.0/4. See the GitHub commit and issue #1218 for the full change set.

Workarounds

Place GoClaw behind an egress proxy that denies traffic to 198.18.0.0/15 and 240.0.0.0/4 until the upgrade is applied.
Enforce network-level egress filtering on the GoClaw host to block reserved and benchmarking ranges outright.
Disable the web_fetch component for untrusted users if a configuration option is available in your deployment.

bash

# Example iptables egress rules to block reserved ranges from the GoClaw host
iptables -A OUTPUT -d 198.18.0.0/15 -j REJECT
iptables -A OUTPUT -d 240.0.0.0/4 -j REJECT