Server-Side Request Forgery in Zevorn RT-Claw Affecting Multiple Versions
CVE-2026-16128

6.9MEDIUM

Key Information:

Vendor: Zevorn
Status: Rt-claw
Vendor: CVE Published:; 18 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16128?

A security vulnerability has been identified in Zevorn RT-Claw up to version 0.2.0. The flaw resides in the receiver_thread function within the http_request component of the file claw/services/swarm/swarm.c. This can lead to server-side request forgery, enabling malicious actors to exploit the vulnerability remotely. The exploit has been publicly disclosed, raising the potential risk for attacks, as the project has not addressed the issue despite prior notifications.

Affected Version(s)

rt-claw 0.1

rt-claw 0.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16128 - Proof of Concept