CVE-2026-16128: zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-18 · updated 2026-10-24
Weakness: CWE-918

Description

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

zevorn rt-claw: 0.1, 0.2.0

References

https://github.com/zevorn/rt-claw/
https://github.com/zevorn/rt-claw/issues/140
https://vuldb.com/cve/CVE-2026-16128
https://vuldb.com/submit/856873
https://vuldb.com/vuln/379840
https://vuldb.com/vuln/379840/cti

Get alerted when CVE-2026-16128 or the next vulnerability affects your stack