CVE-2026-16126
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the Swarm RPC Receiver component. The handle_rpc_request function in claw/services/swarm/swarm.c causes incorrect authorization, allowing remote exploitation. The exploit has been publicly disclosed and may be used.
Risk Assessment
The organization is at risk of remote attacks exploiting incorrect authorization, potentially leading to unauthorized system access and privilege escalation.
Recommendation
Immediately update zevorn rt-claw to the latest version beyond 0.2.0 or apply temporary mitigations such as restricting access to the Swarm RPC Receiver component.
Other vulnerabilities in zevorn rt-claw
See all- CVE-2026-16204Medium
A security flaw in zevorn rt-claw up to version 0.2.0 affects the tool_run_script_execute function in claw/services/tools/script.c. Input manipulation allows remote code injection. The exploit has been publicly released and may be used in attacks.
- CVE-2026-16201Medium
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/services/tools/net.c of the http_request component. Data manipulation leads to information disclosure. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-16128High
A security flaw was discovered in zevorn rt-claw up to version 0.2.0, involving server-side request forgery (SSRF). The issue affects the receiver_thread function in the file claw/services/swarm/swarm.c within the http_request component. The attack can be performed remotely, and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.