The vulnerability CVE-2026-43993 affects Dragonmonk111's junoclaw platform before version 0.x.y-security-1. It is a Server-Side Request Forgery (SSRF) issue classified under CWE-918. The problem arises because the WAVS bridge's computeDataVerify function calls fetch() on URLs supplied by agents without validating critical components such as the URL scheme, port, or the resolved IP address. This improper validation can allow attackers to coerce the server into making unauthorized network requests. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting its high impact on confidentiality and availability. The vendor has released a fixed version (0.x.y-security-1) that addresses this issue.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the affected server perform unauthorized network requests, potentially exposing sensitive internal resources or causing denial of service. The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. There are no reports of active exploitation in the wild.

A fixed version 0.x.y-security-1 of junoclaw is available that addresses this SSRF vulnerability by validating the scheme, port, and resolved IP of URLs before fetching. Users should upgrade to this version to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor's fixed release. Patch status is not explicitly confirmed beyond the version note, so users should consult the vendor advisory or release notes for confirmation.