Is CVE-2026-15620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15620 being exploited in the wild.

How severe is CVE-2026-15620?

Medium severity, with a CVSS score of 6.3, published 14 July 2026.

Is there a fix for CVE-2026-15620?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15620 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15620?

Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15620: mosaxiv clawlet SSRF in tools.webFetch

CVE-2026-15620 · Severity: medium · CVSS 6.3 · Published 2026-07-14

mosaxiv clawlet is a lightweight AI assistant tool. A security flaw in its web fetching component allows an attacker to force the application to make unauthorized requests to internal systems or local services. This could result in the exposure of sensitive internal data, access to private administrative panels, or the ability to probe the internal network from the server's perspective.

Technologies: Mosaxiv Clawlet. Vendors: Mosaxiv.

Quick answers

Is CVE-2026-15620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15620 being exploited in the wild.
How severe is CVE-2026-15620?: Medium severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?: Mosaxiv Clawlet <= 0.2.10.
Is there a fix for CVE-2026-15620?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15620 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15620?: Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `tools.webFetch` function within `tools/tool_web_fetch.go` of mosaxiv clawlet. The issue stems from a default configuration in `config.go` that uses a wildcard allowlist (`*`) for domains and a lack of runtime validation to block loopback (127.0.0.1/localhost) or private RFC1918 IP addresses. A remote attacker with the ability to trigger the `web_fetch` tool can coerce the host into requesting internal HTTP targets and retrieve the response body. As of the advisory date, the GitHub issue was closed as 'not planned,' indicating no official patch is available.

Affected products

mosaxiv clawlet <= 0.2.10

Timeline

2026-07-14: advisory: NVD publication date
2026-07-14: disclosed: Public disclosure of the exploit and GitHub issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.