# CVE-2026-15619: mosaxiv clawlet SSRF in web_fetch function

Source: https://junglewise.ai/threats/cve-2026-15619-mosaxiv-clawlet-ssrf-in-web-fetch-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15619 · Severity: medium · CVSS 6.3 · Published 2026-07-14

mosaxiv clawlet is a lightweight AI assistant tool. A security flaw in its web-fetching component allows the software to be tricked into making unauthorized requests to internal network addresses. This could allow an attacker to probe private internal services or access sensitive data from the local network that is not intended to be public.

Technologies: [Mosaxiv Clawlet](https://junglewise.ai/threats/technologies/clawlet). Vendors: [Mosaxiv](https://junglewise.ai/threats/vendors/mosaxiv).

## Quick answers

**Is CVE-2026-15619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15619 being exploited in the wild.

**How severe is CVE-2026-15619?** Medium severity, with a CVSS score of 6.3, published 14 July 2026.

**Which products and versions are affected?** Mosaxiv Clawlet <= 0.2.10.

**Is there a fix for CVE-2026-15619?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15619 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15619?** Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_fetch` function within `tools/tool_web_fetch.go` of mosaxiv clawlet. The root cause is an incomplete validation policy in `tools/web_fetch_policy.go` that only performs domain-pattern matching and fails to block special-use, private, or loopback IPv4 ranges. A remote attacker can influence the agent to request internal or non-public HTTP services by providing specific IPv4 literal addresses (e.g., 198.18.0.1). While a GitHub issue was opened to report this, the maintainers have marked it as 'not planned,' meaning no official patch is currently available.

## Affected products

- mosaxiv clawlet <= 0.2.10

## Timeline

- 2026-07-14: advisory: NVD publication date
- 2026-07-13: disclosed: GitHub issue reported and closed as not planned

## References

- [https://github.com/mosaxiv/clawlet/](https://github.com/mosaxiv/clawlet/)
- [https://github.com/mosaxiv/clawlet/issues/13](https://github.com/mosaxiv/clawlet/issues/13)
- [https://vuldb.com/cve/CVE-2026-15619](https://vuldb.com/cve/CVE-2026-15619)
- [https://vuldb.com/submit/855793](https://vuldb.com/submit/855793)
- [https://vuldb.com/vuln/378122](https://vuldb.com/vuln/378122)
- [https://vuldb.com/vuln/378122/cti](https://vuldb.com/vuln/378122/cti)

## Related threats

- [mosaxiv clawlet missing authorization in cron Chat Tool](https://junglewise.ai/threats/cve-2026-16017-mosaxiv-clawlet-missing-authorization-in-cron-chat-tool)
- [mosaxiv clawlet workspace bypass via hardlink in File Tools](https://junglewise.ai/threats/cve-2026-15621-mosaxiv-clawlet-workspace-bypass-via-hardlink-in-file-tools)
- [mosaxiv clawlet SSRF in tools.webFetch](https://junglewise.ai/threats/cve-2026-15620-mosaxiv-clawlet-ssrf-in-tools-webfetch)
- [mosaxiv clawlet protection mechanism failure in guardExecCommand](https://junglewise.ai/threats/cve-2026-15618-mosaxiv-clawlet-protection-mechanism-failure-in-guardexeccommand)