Description
A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-18
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the receiver_thread function of the http_request module in zevorn rt‑claw allows an attacker to supply crafted data that causes the server to send HTTP requests on the attacker’s behalf. This server‑side request forgery (CWE‑918) can be used to reach internal resources, exfiltrate information, or launch further attacks from the compromised server.

Affected Systems

The vulnerability affects zevorn rt‑claw releases up to and including version 0.2.0. Any deployment running these releases of the swarm component is vulnerable.

Risk and Exploitability

The CVSS score of 6.9 classifies the flaw as moderate severity. The EPSS score is below 1%, indicating a low current probability of exploitation, yet a public exploit is available, meaning attackers could target vulnerable systems when discovered. The CVE is not listed in the CISA KEV catalog, so widespread weaponized use has not been documented, but the remote attack surface and potential for internal compromise remain significant.

Generated by OpenCVE AI on July 30, 2026 at 22:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Determine whether the deployed instance of zevorn rt‑claw is version 0.2.0 or earlier and plan an upgrade to a newer release that removes the flaw.
  • If a patch cannot be applied immediately, limit inbound traffic to the swarm component using firewall rules or disable the component if it is not required for the application.
  • Configure logging and intrusion detection to monitor for outbound HTTP requests originating from the swarm component and alert on unexpected external destinations.

Generated by OpenCVE AI on July 30, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery
First Time appeared Zevorn
Zevorn rt-claw
Weaknesses CWE-918
CPEs cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*
Vendors & Products Zevorn
Zevorn rt-claw
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zevorn Rt-claw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:27:50.378Z

Reserved: 2026-07-17T16:08:54.648Z

Link: CVE-2026-16128

cve-icon Vulnrichment

Updated: 2026-07-20T13:27:46.376Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)