CVE-2026-15620: mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-918

Description

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/tool_web_fetch.go. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed with the label "not planned".

Affected products

mosaxiv clawlet: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5 (+5)

References

https://github.com/mosaxiv/clawlet/
https://github.com/mosaxiv/clawlet/issues/14
https://vuldb.com/cve/CVE-2026-15620
https://vuldb.com/submit/855795
https://vuldb.com/vuln/378123
https://vuldb.com/vuln/378123/cti

Get alerted when CVE-2026-15620 or the next vulnerability affects your stack