Description
A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-18
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote attacker can manipulate the URL argument to the claw_net_get/claw_net_post functions in zevorn RT‑Claw, causing the application to make outbound HTTP requests that the attacker controls. This server‑side request forgery can be used to probe internal network services, access restricted resources, or exfiltrate data. The weakness is the improper validation of user‑supplied URLs and is classified as CWE‑918.

Affected Systems

zevorn RT‑Claw, versions up to and including 0.2.0. No other vendors or product lines are affected.

Risk and Exploitability

The CVSS score of 6.9 places the vulnerability in the medium‑to‑high severity range. The EPSS score is below 1 %, indicating a low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is remote and URL, after which the server will attempt the request to the specified target.

Generated by OpenCVE AI on July 30, 2026 at 22:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update zevorn RT‑Claw to a version that removes the vulnerable claw_net_get/claw_net_post functions
  • Configure your network to block or inspect outbound HTTP requests from the RT‑Claw service or use a proxy to enforce allowed destinations
  • Apply network segmentation so that the RT‑Claw service cannot reach critical internal resources, limiting the impact if SSRF is still possible

Generated by OpenCVE AI on July 30, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title zevorn rt-claw http_request net.c claw_net_post server-side request forgery
First Time appeared Zevorn
Zevorn rt-claw
Weaknesses CWE-918
CPEs cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*
Vendors & Products Zevorn
Zevorn rt-claw
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zevorn Rt-claw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-21T02:45:29.691Z

Reserved: 2026-07-17T16:08:22.751Z

Link: CVE-2026-16125

cve-icon Vulnrichment

Updated: 2026-07-21T02:45:26.216Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)