The vulnerability CVE-2026-10583 affects nextlevelbuilder GoClaw up to version 3.11.3. It is located in the Import function within the internal/http/tts_config.go file of the TTS Configuration Endpoint component. The issue allows an attacker to perform server-side request forgery (SSRF) remotely. The vulnerability has been publicly disclosed, but no official fix or patch has been documented. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and privileges required, with low impact on confidentiality, integrity, and availability.

An attacker with the required privileges can remotely exploit this SSRF vulnerability to cause the server to make unintended requests. The impact is rated medium with limited confidentiality, integrity, and availability impact. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the vulnerable Import function and applying network-level controls to limit outbound requests from the affected server if feasible.