PT-2026-60767 · Poco Ai · Poco-Claw

Erichen · CVE-2026-16016 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run task of the file executor/app/api/v1/task.py. The manipulation of the argument callback url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-16016

Affected Products

Poco-Claw

References · 7

• 🔥 https://github.com/poco-ai/poco-claw · Exploit
• 🔥 https://github.com/poco-ai/poco-claw/issues/138 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16016 · Security Note
• https://vuldb.com/cve/CVE-2026-16016 · Note
• https://vuldb.com/vuln/379758/cti · Note
• https://vuldb.com/vuln/379758 · Note
• https://vuldb.com/submit/856814 · Note