CVE-2026-16200
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the claw_tool_invoke function of the RPC handler. Incorrect authorization allows remote exploitation without proper privileges. The exploit is public and the project has not responded to the issue report.
Risk Assessment
The organization is at risk of remote system compromise or unauthorized RPC access, potentially leading to data breaches. The public exploit increases the likelihood of immediate attacks.
Recommendation
Immediately update rt-claw to a version above 0.2.0 if available, or apply a temporary workaround such as restricting RPC access via firewall. Monitor systems for exploitation attempts.
Other vulnerabilities in rt-claw
See all- CVE-2026-16127High
A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/tools/tool_net.c. Manipulation of the url argument leads to server-side request forgery (SSRF). The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-16125High
A server-side request forgery (SSRF) vulnerability was found in the rt-claw library up to version 0.2.0 in the claw_net_get and claw_net_post functions. The issue is in the file claw/services/tools/net.c, where the url argument can be manipulated by an attacker. The exploit has been made public, and the project has not responded to the report.
Original NVD description (English source)
A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.