CVE-2026-161246.3MediumCWE-918

CVE-2026-16124: nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery

nextlevelbuilder · GoClaw

Vendor fix available · Affected: nextlevelbuilder GoClaw · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

40th percentile

050100

Higher than 40% of scored CVEs

6.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

nextlevelbuilder · GoClaw3.15.0-beta.0; 3.15.0-beta.1; 3.15.0-beta.2; 3.15.0-beta.3; 3.15.0-beta.4; 3.15.0-beta.5 and 27 more

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Server-Side Request Forgery
Vendor: nextlevelbuilder
Published: July 2026
Band: Unlikely (under 1%), July 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-16124 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.