Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5700 vulnerabilities reference this CWE, most recent first.
CVE-2026-16194 (GCVE-0-2026-16194)
Vulnerability from cvelistv5 – Published: 2026-07-18 21:15 – Updated: 2026-07-20 13:54 X_Open Source
VLAI
EPSS
VEX
Title
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
Summary
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 13:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380009 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380009/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16194 | third-party-advisory |
| https://vuldb.com/submit/857620 | third-party-advisory |
| https://github.com/zhayujie/CowAgent/issues/2889 | exploitissue-tracking |
| https://github.com/zhayujie/CowAgent/pull/2900 | issue-trackingpatch |
| https://github.com/zhayujie/CowAgent/commit/ea47f… | patch |
| https://github.com/zhayujie/CowAgent/releases/tag/2.1.2 | patch |
| https://github.com/zhayujie/CowAgent/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16194",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:54:37.147585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:54:55.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*"
],
"product": "CowAgent",
"vendor": "zhayujie",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "unaffected",
"version": "2.1.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-x (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T21:15:10.826Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380009 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380009"
},
{
"name": "VDB-380009 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380009/cti"
},
{
"name": "CVE-2026-16194 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16194"
},
{
"name": "Submit #857620 | zhayujie CowAgent 2.1.1 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857620"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zhayujie/CowAgent/issues/2889"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/pull/2900"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/commit/ea47f3097eed4f8295c4cb3d76ecb97e0f43d632"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zhayujie/CowAgent/releases/tag/2.1.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/zhayujie/CowAgent/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-18T04:42:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16194",
"datePublished": "2026-07-18T21:15:10.826Z",
"dateReserved": "2026-07-18T02:37:49.144Z",
"dateUpdated": "2026-07-20T13:54:55.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16128 (GCVE-0-2026-16128)
Vulnerability from cvelistv5 – Published: 2026-07-18 16:30 – Updated: 2026-07-20 13:27
VLAI
EPSS
VEX
Title
zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery
Summary
A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 13:27 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379840 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379840/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16128 | third-party-advisory |
| https://vuldb.com/submit/856873 | third-party-advisory |
| https://github.com/zevorn/rt-claw/issues/140 | exploitissue-tracking |
| https://github.com/zevorn/rt-claw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16128",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:27:42.885840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:27:50.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"
],
"modules": [
"http_request"
],
"product": "rt-claw",
"vendor": "zevorn",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-y (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T16:30:08.241Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379840 | zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379840"
},
{
"name": "VDB-379840 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379840/cti"
},
{
"name": "CVE-2026-16128 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16128"
},
{
"name": "Submit #856873 | zevorn rt-claw 0.2.0 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856873"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zevorn/rt-claw/issues/140"
},
{
"tags": [
"product"
],
"url": "https://github.com/zevorn/rt-claw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:14:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16128",
"datePublished": "2026-07-18T16:30:08.241Z",
"dateReserved": "2026-07-17T16:08:54.648Z",
"dateUpdated": "2026-07-20T13:27:50.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16127 (GCVE-0-2026-16127)
Vulnerability from cvelistv5 – Published: 2026-07-18 16:00 – Updated: 2026-07-20 15:08
VLAI
EPSS
VEX
Title
zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
Summary
A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 15:08 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379839 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379839/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16127 | third-party-advisory |
| https://vuldb.com/submit/856872 | third-party-advisory |
| https://github.com/zevorn/rt-claw/issues/139 | exploitissue-tracking |
| https://github.com/zevorn/rt-claw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16127",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T15:08:27.246883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:08:39.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"
],
"modules": [
"http_request"
],
"product": "rt-claw",
"vendor": "zevorn",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-y (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T16:00:08.864Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379839 | zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379839"
},
{
"name": "VDB-379839 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379839/cti"
},
{
"name": "CVE-2026-16127 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16127"
},
{
"name": "Submit #856872 | zevorn rt-claw 0.2.0 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856872"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zevorn/rt-claw/issues/139"
},
{
"tags": [
"product"
],
"url": "https://github.com/zevorn/rt-claw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:13:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16127",
"datePublished": "2026-07-18T16:00:08.864Z",
"dateReserved": "2026-07-17T16:08:33.195Z",
"dateUpdated": "2026-07-20T15:08:39.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16125 (GCVE-0-2026-16125)
Vulnerability from cvelistv5 – Published: 2026-07-18 15:15 – Updated: 2026-07-21 02:45
VLAI
EPSS
VEX
Title
zevorn rt-claw http_request net.c claw_net_post server-side request forgery
Summary
A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:45 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379837 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379837/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16125 | third-party-advisory |
| https://vuldb.com/submit/856869 | third-party-advisory |
| https://github.com/zevorn/rt-claw/issues/134 | exploitissue-tracking |
| https://github.com/zevorn/rt-claw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16125",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:45:21.424420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:45:29.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"
],
"modules": [
"http_request"
],
"product": "rt-claw",
"vendor": "zevorn",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-y (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:15:08.064Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379837 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379837"
},
{
"name": "VDB-379837 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379837/cti"
},
{
"name": "CVE-2026-16125 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16125"
},
{
"name": "Submit #856869 | zevorn rt-claw unreleased post-v0.2.0 (36d128f) Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856869"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zevorn/rt-claw/issues/134"
},
{
"tags": [
"product"
],
"url": "https://github.com/zevorn/rt-claw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:13:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "zevorn rt-claw http_request net.c claw_net_post server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16125",
"datePublished": "2026-07-18T15:15:08.064Z",
"dateReserved": "2026-07-17T16:08:22.751Z",
"dateUpdated": "2026-07-21T02:45:29.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16124 (GCVE-0-2026-16124)
Vulnerability from cvelistv5 – Published: 2026-07-18 15:00 – Updated: 2026-07-20 16:55 X_Open Source
VLAI
EPSS
VEX
Title
nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery
Summary
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 16:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379833 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379833/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16124 | third-party-advisory |
| https://vuldb.com/submit/856858 | third-party-advisory |
| https://github.com/nextlevelbuilder/goclaw/issues/1218 | exploitissue-tracking |
| https://github.com/nextlevelbuilder/goclaw/pull/1269 | issue-trackingpatch |
| https://github.com/nextlevelbuilder/goclaw/commit… | patch |
| https://github.com/nextlevelbuilder/goclaw/releas… | patch |
| https://github.com/nextlevelbuilder/goclaw/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nextlevelbuilder | GoClaw |
Affected:
3.15.0-beta.0
Affected: 3.15.0-beta.1 Affected: 3.15.0-beta.2 Affected: 3.15.0-beta.3 Affected: 3.15.0-beta.4 Affected: 3.15.0-beta.5 Affected: 3.15.0-beta.6 Affected: 3.15.0-beta.7 Affected: 3.15.0-beta.8 Affected: 3.15.0-beta.9 Affected: 3.15.0-beta.10 Affected: 3.15.0-beta.11 Affected: 3.15.0-beta.12 Affected: 3.15.0-beta.13 Affected: 3.15.0-beta.14 Affected: 3.15.0-beta.15 Affected: 3.15.0-beta.16 Affected: 3.15.0-beta.17 Affected: 3.15.0-beta.18 Affected: 3.15.0-beta.19 Affected: 3.15.0-beta.20 Affected: 3.15.0-beta.21 Affected: 3.15.0-beta.22 Affected: 3.15.0-beta.23 Affected: 3.15.0-beta.24 Affected: 3.15.0-beta.25 Affected: 3.15.0-beta.26 Affected: 3.15.0-beta.27 Affected: 3.15.0-beta.28 Affected: 3.15.0-beta.29 Affected: 3.15.0-beta.30 Affected: 3.15.0-beta.31 Affected: 3.15.0-beta.32 Unaffected: 3.15.0-beta.33 cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16124",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T16:54:36.331473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T16:55:09.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"web_fetch"
],
"product": "GoClaw",
"vendor": "nextlevelbuilder",
"versions": [
{
"status": "affected",
"version": "3.15.0-beta.0"
},
{
"status": "affected",
"version": "3.15.0-beta.1"
},
{
"status": "affected",
"version": "3.15.0-beta.2"
},
{
"status": "affected",
"version": "3.15.0-beta.3"
},
{
"status": "affected",
"version": "3.15.0-beta.4"
},
{
"status": "affected",
"version": "3.15.0-beta.5"
},
{
"status": "affected",
"version": "3.15.0-beta.6"
},
{
"status": "affected",
"version": "3.15.0-beta.7"
},
{
"status": "affected",
"version": "3.15.0-beta.8"
},
{
"status": "affected",
"version": "3.15.0-beta.9"
},
{
"status": "affected",
"version": "3.15.0-beta.10"
},
{
"status": "affected",
"version": "3.15.0-beta.11"
},
{
"status": "affected",
"version": "3.15.0-beta.12"
},
{
"status": "affected",
"version": "3.15.0-beta.13"
},
{
"status": "affected",
"version": "3.15.0-beta.14"
},
{
"status": "affected",
"version": "3.15.0-beta.15"
},
{
"status": "affected",
"version": "3.15.0-beta.16"
},
{
"status": "affected",
"version": "3.15.0-beta.17"
},
{
"status": "affected",
"version": "3.15.0-beta.18"
},
{
"status": "affected",
"version": "3.15.0-beta.19"
},
{
"status": "affected",
"version": "3.15.0-beta.20"
},
{
"status": "affected",
"version": "3.15.0-beta.21"
},
{
"status": "affected",
"version": "3.15.0-beta.22"
},
{
"status": "affected",
"version": "3.15.0-beta.23"
},
{
"status": "affected",
"version": "3.15.0-beta.24"
},
{
"status": "affected",
"version": "3.15.0-beta.25"
},
{
"status": "affected",
"version": "3.15.0-beta.26"
},
{
"status": "affected",
"version": "3.15.0-beta.27"
},
{
"status": "affected",
"version": "3.15.0-beta.28"
},
{
"status": "affected",
"version": "3.15.0-beta.29"
},
{
"status": "affected",
"version": "3.15.0-beta.30"
},
{
"status": "affected",
"version": "3.15.0-beta.31"
},
{
"status": "affected",
"version": "3.15.0-beta.32"
},
{
"status": "unaffected",
"version": "3.15.0-beta.33"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-g (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:11.635Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379833 | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379833"
},
{
"name": "VDB-379833 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379833/cti"
},
{
"name": "CVE-2026-16124 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16124"
},
{
"name": "Submit #856858 | nextlevelbuilder GoClaw 3.13.3-beta.3 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856858"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/nextlevelbuilder/goclaw/issues/1218"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nextlevelbuilder/goclaw/pull/1269"
},
{
"tags": [
"patch"
],
"url": "https://github.com/nextlevelbuilder/goclaw/commit/12a0168271827650ddb0026d6277fbadf3dcf3ea"
},
{
"tags": [
"patch"
],
"url": "https://github.com/nextlevelbuilder/goclaw/releases/tag/v3.15.0-beta.33"
},
{
"tags": [
"product"
],
"url": "https://github.com/nextlevelbuilder/goclaw/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:02:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16124",
"datePublished": "2026-07-18T15:00:11.635Z",
"dateReserved": "2026-07-17T15:57:06.671Z",
"dateUpdated": "2026-07-20T16:55:09.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16084 (GCVE-0-2026-16084)
Vulnerability from cvelistv5 – Published: 2026-07-18 09:00 – Updated: 2026-07-21 02:28 X_Open Source
VLAI
EPSS
VEX
Title
Sipeed PicoClaw web.go web_fetch server-side request forgery
Summary
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 02:27 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379796 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379796/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16084 | third-party-advisory |
| https://vuldb.com/submit/852946 | third-party-advisory |
| https://github.com/sipeed/picoclaw/issues/3074 | exploitissue-tracking |
| https://github.com/sipeed/picoclaw/pull/3143 | issue-trackingpatch |
| https://github.com/sipeed/picoclaw/commit/c15aac2… | patch |
| https://github.com/sipeed/picoclaw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T02:27:55.393932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:28:05.666Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"
],
"product": "PicoClaw",
"vendor": "Sipeed",
"versions": [
{
"status": "affected",
"version": "0.2.0"
},
{
"status": "affected",
"version": "0.2.1"
},
{
"status": "affected",
"version": "0.2.2"
},
{
"status": "affected",
"version": "0.2.3"
},
{
"status": "affected",
"version": "0.2.4"
},
{
"status": "affected",
"version": "0.2.5"
},
{
"status": "affected",
"version": "0.2.6"
},
{
"status": "affected",
"version": "0.2.7"
},
{
"status": "affected",
"version": "0.2.8"
},
{
"status": "affected",
"version": "0.2.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-i (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T09:00:10.981Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379796 | Sipeed PicoClaw web.go web_fetch server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379796"
},
{
"name": "VDB-379796 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379796/cti"
},
{
"name": "CVE-2026-16084 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16084"
},
{
"name": "Submit #852946 | Sipeed PicoClaw \u003c= 0.2.9 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852946"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/sipeed/picoclaw/issues/3074"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/sipeed/picoclaw/pull/3143"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392"
},
{
"tags": [
"product"
],
"url": "https://github.com/sipeed/picoclaw/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T15:55:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Sipeed PicoClaw web.go web_fetch server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16084",
"datePublished": "2026-07-18T09:00:10.981Z",
"dateReserved": "2026-07-17T13:50:07.157Z",
"dateUpdated": "2026-07-21T02:28:05.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16074 (GCVE-0-2026-16074)
Vulnerability from cvelistv5 – Published: 2026-07-17 20:15 – Updated: 2026-07-20 17:57
VLAI
EPSS
VEX
Title
AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery
Summary
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download_url/download_urls/proxy results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 17:53 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379789 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379789/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16074 | third-party-advisory |
| https://vuldb.com/submit/852842 | third-party-advisory |
| https://gist.github.com/YLChen-007/f84070f78d9c9c… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AstrBotDevs | AstrBot |
Affected:
4.25.0
Affected: 4.25.1 Affected: 4.25.2 cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16074",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T17:53:51.939928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T17:57:32.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*"
],
"modules": [
"Plugin Update Handler"
],
"product": "AstrBot",
"vendor": "AstrBotDevs",
"versions": [
{
"status": "affected",
"version": "4.25.0"
},
{
"status": "affected",
"version": "4.25.1"
},
{
"status": "affected",
"version": "4.25.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download_url/download_urls/proxy results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T20:15:09.598Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379789 | AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379789"
},
{
"name": "VDB-379789 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379789/cti"
},
{
"name": "CVE-2026-16074 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16074"
},
{
"name": "Submit #852842 | AstrBotDevs AstrBot 4.25.2 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852842"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/f84070f78d9c9c9407b0c396189cd716"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T15:44:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16074",
"datePublished": "2026-07-17T20:15:09.598Z",
"dateReserved": "2026-07-17T13:39:22.213Z",
"dateUpdated": "2026-07-20T17:57:32.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16027 (GCVE-0-2026-16027)
Vulnerability from cvelistv5 – Published: 2026-08-07 07:14 – Updated: 2026-08-07 15:24
VLAI
EPSS
VEX
Title
Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature
Summary
Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery.
This issue affects Türkiye's E-Signature: from 2.4.4.0 before 2.5.1.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 15:23 UTC
CWE
- CWE-918 - Server-Side request forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Revenue Administration | E-Signature |
Affected:
2.4.4.0 , < 2.5.1.0
(custom)
|
Date Public
2026-08-07 07:09
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16027",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:23:01.841632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:24:12.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "E-Signature",
"vendor": "Revenue Administration",
"versions": [
{
"lessThan": "2.5.1.0",
"status": "affected",
"version": "2.4.4.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sangsoo Jeong"
}
],
"datePublic": "2026-08-07T07:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server-Side request forgery (SSRF) vulnerability in Revenue Administration T\u00fcrkiye\u0027s E-Signature allows Server Side Request Forgery.\u003cp\u003eThis issue affects T\u00fcrkiye\u0027s E-Signature: from 2.4.4.0 before 2.5.1.0.\u003c/p\u003e"
}
],
"value": "Server-Side request forgery (SSRF) vulnerability in Revenue Administration T\u00fcrkiye\u0027s E-Signature allows Server Side Request Forgery.\n\nThis issue affects T\u00fcrkiye\u0027s E-Signature: from 2.4.4.0 before 2.5.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T08:54:04.344Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0772"
}
],
"source": {
"advisory": "TR-26-0772",
"defect": [
"TR-26-0772"
],
"discovery": "UNKNOWN"
},
"title": "Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration\u0027s E-Signature",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-16027",
"datePublished": "2026-08-07T07:14:12.771Z",
"dateReserved": "2026-07-17T08:21:50.945Z",
"dateUpdated": "2026-08-07T15:24:12.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16016 (GCVE-0-2026-16016)
Vulnerability from cvelistv5 – Published: 2026-07-17 13:30 – Updated: 2026-07-17 14:51
VLAI
EPSS
VEX
Title
poco-ai poco-claw task.py run_task server-side request forgery
Summary
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 14:51 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379758 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379758/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16016 | third-party-advisory |
| https://vuldb.com/submit/856814 | third-party-advisory |
| https://github.com/poco-ai/poco-claw/issues/138 | exploitissue-tracking |
| https://github.com/poco-ai/poco-claw/ | exploitproduct |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16016",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T14:51:15.201300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T14:51:53.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:poco-ai:poco-claw:*:*:*:*:*:*:*:*"
],
"product": "poco-claw",
"vendor": "poco-ai",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erichen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T13:30:10.299Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379758 | poco-ai poco-claw task.py run_task server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379758"
},
{
"name": "VDB-379758 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379758/cti"
},
{
"name": "CVE-2026-16016 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16016"
},
{
"name": "Submit #856814 | poco-ai poco-agent 0.5.4 Server-Side Request Forgery / SSRF (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856814"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/poco-ai/poco-claw/issues/138"
},
{
"tags": [
"exploit",
"product"
],
"url": "https://github.com/poco-ai/poco-claw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T07:49:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "poco-ai poco-claw task.py run_task server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16016",
"datePublished": "2026-07-17T13:30:10.299Z",
"dateReserved": "2026-07-17T05:44:08.705Z",
"dateUpdated": "2026-07-17T14:51:53.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15927 (GCVE-0-2026-15927)
Vulnerability from cvelistv5 – Published: 2026-07-21 04:45 – Updated: 2026-09-09 22:05
VLAI
EPSS
VEX
Title
Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
Summary
A flaw was found in Red Hat Quay's repository-level mirror configuration
feature. The POST and PUT handlers in endpoints/api/mirror.py accept an
external_reference parameter without SSRF validation, unlike the
organization-level mirror handlers which apply validate_external_registry_url().
A repository administrator can supply a crafted hostname that causes the Quay
mirror worker to make requests via Skopeo to internal network services, cloud
metadata endpoints, or other resources not intended to be reachable from the
Quay application.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 13:12 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:50931 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:52968 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:53520 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:54395 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:63307 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-15927 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2501256 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Quay 3.10 |
Unaffected:
1786395065 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1786170635 , < *
(rpm)
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1788191755 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.17 |
Unaffected:
1786181981 , < *
(rpm)
cpe:/a:redhat:quay:3.17::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1785950004 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | mirror registry for Red Hat OpenShift 2 |
cpe:/a:redhat:mirror_registry:2
|
Date Public
2026-07-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15927",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T13:12:11.259508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T14:55:42.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786395065",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786170635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1788191755",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786181981",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785950004",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:mirror_registry:2"
],
"defaultStatus": "affected",
"packageName": "openshift/mirror-registry-rhel8",
"product": "mirror registry for Red Hat OpenShift 2",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Martin Brodeur and Shaon Hossain (Red Hat)."
}
],
"datePublic": "2026-07-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Red Hat Quay\u0027s repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T22:05:45.812Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:50931",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50931"
},
{
"name": "RHSA-2026:52968",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52968"
},
{
"name": "RHSA-2026:53520",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53520"
},
{
"name": "RHSA-2026:54395",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54395"
},
{
"name": "RHSA-2026:63307",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:63307"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-15927"
},
{
"name": "RHBZ#2501256",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-13T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-07-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation",
"workarounds": [
{
"lang": "en",
"value": "Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay\u0027s RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-15927",
"datePublished": "2026-07-21T04:45:27.751Z",
"dateReserved": "2026-07-16T06:31:41.405Z",
"dateUpdated": "2026-09-09T22:05:45.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.