The vulnerability CVE-2026-15619 affects mosaxiv clawlet up to version 0.2.10 in the web_fetch function of the IPv4 Handler component. It allows remote attackers to perform server-side request forgery by manipulating the url argument passed to this function. The vulnerability is confirmed and publicly disclosed, but no official remediation or patch is available as the vendor closed the issue as 'not planned'. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial impacts on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to cause the server to make unauthorized requests to internal or external resources. This can lead to information disclosure, unauthorized interactions with internal systems, or other indirect impacts depending on the server's network environment. The CVSS score indicates a medium severity with partial impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

No official fix or patch is currently available for this vulnerability, as the vendor has marked the issue as 'not planned'. Users should consider mitigating exposure by restricting access to the vulnerable functionality, applying network-level controls to limit outbound requests from the server, or isolating the affected service. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.