The vulnerability CVE-2026-10583 affects the Import function in the TTS Configuration Endpoint of nextlevelbuilder GoClaw up to version 3.11.3. It allows an attacker with high privileges to remotely trigger server-side request forgery, potentially causing the server to make unintended requests. The vulnerability is confirmed publicly disclosed, but no official fix or patch has been released by the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required for attack initiation, and low impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this SSRF vulnerability to make the server perform unauthorized requests. The impact is rated medium with limited confidentiality, integrity, and availability impact. There are no known exploits in the wild at this time. The vulnerability requires high privileges to exploit, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the vulnerable Import function or applying network-level controls to limit outbound requests from the server if feasible.