CVE-2026-16200 describes an authorization vulnerability in the claw_tool_invoke function of the claw/services/swarm/swarm.c file within zevorn rt-claw versions up to 0.2.0. The issue allows an attacker to bypass proper authorization checks remotely, potentially enabling unauthorized actions through the RPC Handler component. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or response. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and a moderate severity rating.

The vulnerability enables remote attackers to bypass authorization controls in the affected function, potentially allowing unauthorized access or actions within the affected component. This could lead to unauthorized operations being performed remotely without authentication, impacting the security of systems running vulnerable versions of zevorn rt-claw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service or component to trusted sources to reduce exposure.