Attack Chain

1. An attacker discovers an internet-facing instance of poco-ai poco-claw version 0.5.4 or earlier.
2. The attacker crafts an HTTP POST request targeting the run_task function exposed via the /api/v1/task.py endpoint on the vulnerable server.
3. Within the request, the attacker provides a maliciously constructed internal or external URL as the value for the callback_url argument.
4. The vulnerable poco-claw application, lacking proper input validation for the callback_url parameter, processes the run_task request.
5. The run_task function initiates an outbound HTTP request from the poco-claw host to the URL specified by the attacker in callback_url.
6. This server-side request is performed by the poco-claw instance, allowing the attacker to interact with internal network resources, bypass firewall restrictions, or perform network scans from the server's context.
7. The attacker receives or infers the response to the SSRF-induced request, gathering information about internal services or performing actions on behalf of the poco-claw server.
8. This gained access or information can then be leveraged for further reconnaissance, lateral movement within the network, or data exfiltration.

Impact

Successful exploitation of CVE-2026-16016 leads to server-side request forgery, which can have significant consequences. Attackers can leverage this to bypass network access controls, scan internal networks, access sensitive internal services, or exfiltrate data from systems that are otherwise unreachable from the internet. The remote exploitability and public availability of exploit code increase the likelihood of widespread attacks, potentially leading to unauthorized access to critical internal infrastructure and sensitive information.

Recommendation

• Patch all poco-ai poco-claw instances to a version greater than 0.5.4 immediately to remediate CVE-2026-16016.
• Deploy the Sigma rule "Detect Potential Server-Side Request Forgery to Private IPs" to your SIEM and tune it for your environment.
• Enable comprehensive network connection logging for servers running poco-claw applications to monitor for unusual outbound requests.
• Implement outbound firewall rules to restrict network connections initiated by the poco-claw application only to necessary and approved destinations.