CVE-2026-16128
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A security flaw was discovered in zevorn rt-claw up to version 0.2.0, involving server-side request forgery (SSRF). The issue affects the receiver_thread function in the file claw/services/swarm/swarm.c within the http_request component. The attack can be performed remotely, and the exploit has been publicly released.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources through forged HTTP requests, potentially leading to data leakage or further attack escalation.
Recommendation
Immediately update the zevorn rt-claw library to a version newer than 0.2.0 if available, or apply a temporary workaround such as restricting access to the http_request component.
Other vulnerabilities in zevorn rt-claw
See all- CVE-2026-16204Medium
A security flaw in zevorn rt-claw up to version 0.2.0 affects the tool_run_script_execute function in claw/services/tools/script.c. Input manipulation allows remote code injection. The exploit has been publicly released and may be used in attacks.
- CVE-2026-16201Medium
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/services/tools/net.c of the http_request component. Data manipulation leads to information disclosure. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-16126High
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the Swarm RPC Receiver component. The handle_rpc_request function in claw/services/swarm/swarm.c causes incorrect authorization, allowing remote exploitation. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.