Executive brief
Poco-claw is an AI agent execution platform. A security flaw in its task execution component allows an attacker to force the server to make unauthorized web requests to internal systems or external websites. This could lead to the exposure of sensitive internal data, unauthorized access to private cloud services, or the leakage of task metadata to an attacker-controlled server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `run_task` function within `executor/app/api/v1/task.py`. The application accepts an untrusted `callback_url` via a POST request to `/v1/tasks/execute` and subsequently performs an HTTP POST to that destination using `CallbackClient` without validating the URL against an allowlist or blocking internal/loopback addresses. An unauthenticated remote attacker can exploit this to use the executor host as a proxy to scan internal networks, access cloud metadata services, or intercept callback data containing session metadata. As of the advisory date, the GitHub issue was closed due to inactivity without a formal patch.
Affected products
- poco-ai poco-claw <= 0.5.4
Timeline
- 2026-06-12: disclosed: GitHub issue #138 opened describing the SSRF vulnerability
- 2026-07-17: advisory: CVE-2026-16016 published via VulDB/NVD