The vulnerability CVE-2026-16125 affects zevorn rt-claw versions 0.1 and 0.2.0. It arises from improper handling of the URL argument in the claw_net_get and claw_net_post functions of the claw/services/tools/net.c file, enabling server-side request forgery. This allows an attacker to cause the server to send crafted requests to arbitrary destinations. The vulnerability can be exploited remotely without authentication. Although the issue was disclosed to the project early, no remediation or patch has been released as of the publication date. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server perform unauthorized requests to internal or external systems. This may lead to information disclosure or interaction with internal services not directly accessible to the attacker. The impact on confidentiality, integrity, and availability is rated as low to limited by the CVSS 4.0 vector. No known exploits in the wild have been reported.

No official fix or patch is currently available for this vulnerability. The vendor has not responded to the issue report. Users of affected versions (0.1 and 0.2.0) should consider restricting or monitoring network access from the affected functions if possible, or avoid using these versions until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.