# CVE-2026-15624: nextlevelbuilder GoClaw SSRF in bytePlusDownloadVideo

Source: https://junglewise.ai/threats/cve-2026-15624-nextlevelbuilder-goclaw-ssrf-in-byteplusdownloadvideo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15624 · Severity: medium · CVSS 6.3 · Published 2026-07-14

nextlevelbuilder GoClaw is an AI agent deployment platform. A security flaw in its video generation component allows the system to be tricked into making unauthorized network requests to internal servers. An attacker with basic access could use this to scan private company networks or access sensitive internal data that is not intended to be public.

Technologies: [Nextlevelbuilder GoClaw](https://junglewise.ai/threats/technologies/goclaw). Vendors: [Nextlevelbuilder](https://junglewise.ai/threats/vendors/nextlevelbuilder).

## Quick answers

**Is CVE-2026-15624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15624 being exploited in the wild.

**How severe is CVE-2026-15624?** Medium severity, with a CVSS score of 6.3, published 14 July 2026.

**Which products and versions are affected?** Nextlevelbuilder GoClaw 3.13.3-beta.3.

**Is there a fix for CVE-2026-15624?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15624 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15624?** Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `bytePlusDownloadVideo` function within `internal/tools/create_video_byteplus.go` of GoClaw 3.13.3-beta.3. The application trusts provider-returned media download URLs and fetches them using a standard `http.Client` without applying the project's existing SSRF protections or pinned-IP validation. An authenticated operator can invoke the `create_video` tool; if the upstream provider (or a spoofed provider) returns a malicious `video_url`, the server will execute a GET request to that URL from its own network context. This allows access to loopback interfaces, metadata endpoints, and other internal network resources. Similar unsafe patterns were identified in the Gemini and MiniMax video tool implementations.

## Affected products

- nextlevelbuilder GoClaw 3.13.3-beta.3

## Timeline

- 2026-07-14: advisory: NVD publication date
- 2026-07-13: disclosed: Public GitHub issue report

## References

- [https://github.com/nextlevelbuilder/goclaw/](https://github.com/nextlevelbuilder/goclaw/)
- [https://github.com/nextlevelbuilder/goclaw/issues/1199](https://github.com/nextlevelbuilder/goclaw/issues/1199)
- [https://vuldb.com/cve/CVE-2026-15624](https://vuldb.com/cve/CVE-2026-15624)
- [https://vuldb.com/submit/855798](https://vuldb.com/submit/855798)
- [https://vuldb.com/vuln/378126](https://vuldb.com/vuln/378126)
- [https://vuldb.com/vuln/378126/cti](https://vuldb.com/vuln/378126/cti)

## Related threats

- [nextlevelbuilder GoClaw Information Disclosure in jq Handler](https://junglewise.ai/threats/cve-2026-18038-nextlevelbuilder-goclaw-information-disclosure-in-jq-handler)
- [nextlevelbuilder GoClaw authorization bypass in ExecTool.Execute](https://junglewise.ai/threats/cve-2026-16199-nextlevelbuilder-goclaw-authorization-bypass-in-exectool-execute)
- [nextlevelbuilder GoClaw SSRF in web_fetch component](https://junglewise.ai/threats/cve-2026-16124-nextlevelbuilder-goclaw-ssrf-in-web-fetch-component)
- [nextlevelbuilder GoClaw authorization bypass in ToolsInvokeHandler](https://junglewise.ai/threats/cve-2026-16123-nextlevelbuilder-goclaw-authorization-bypass-in)
- [nextlevelbuilder GoClaw authorization bypass in exec approval flow](https://junglewise.ai/threats/cve-2026-16122-nextlevelbuilder-goclaw-authorization-bypass-in-exec-approval)