CVE-2026-16200: medium-severity vulnerability in zevorn rt-claw
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.5%
A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
zevorn · rt-clawpublic PoCs found — 1
cve_referencegithub.com/zevorn/rt-claw/issues/133unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zevorn rt-claw
In the same product, most dangerous first.
CVE-2026-16204MEDIUMzevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injectionEPSS 0.5%CVE-2026-16201MEDIUMzevorn rt-claw http_request net.c claw_net_post information disclosureEPSS 0.5%CVE-2026-16126MEDIUMzevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorizationEPSS 0.5%CVE-2026-16128MEDIUMzevorn rt-claw http_request swarm.c receiver_thread server-side request forgeryEPSS 0.5%CVE-2026-16127MEDIUMzevorn rt-claw http_request tool_net.c claw_net_post server-side request forgeryEPSS 0.5%CVE-2026-16125MEDIUMzevorn rt-claw http_request net.c claw_net_post server-side request forgeryEPSS 0.5%