The vulnerability CVE-2026-16127 in zevorn rt-claw up to version 0.2.0 allows remote attackers to perform server-side request forgery via manipulation of the URL argument in the claw_net_get and claw_net_post functions of the http_request component. This flaw resides in claw/tools/tool_net.c and enables attackers to make the server send arbitrary requests, potentially leading to unauthorized internal network access or data exposure. The project has been informed but has not issued a fix or response. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows an attacker to induce the vulnerable server to make arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further attacks within the internal network. The vulnerability is remotely exploitable without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected application to trusted destinations only.