CVE-2026-16127 is a server-side request forgery vulnerability affecting zevorn rt-claw up to version 0.2.0. The issue resides in the claw_net_get and claw_net_post functions of claw/tools/tool_net.c, where improper validation of the URL argument allows an attacker to cause the server to make unintended HTTP requests. This vulnerability can be exploited remotely without authentication. The project was notified early but has not issued a fix or response. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to induce the affected server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. This can lead to information disclosure or further attacks leveraging internal network access. The vulnerability does not require user interaction or privileges, increasing its risk. However, no active exploitation in the wild has been confirmed.

No official patch or fix is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should monitor the vendor advisory for updates. Until a fix is released, consider implementing network-level controls to restrict outbound HTTP requests from the affected application and validate or sanitize URL inputs where possible to mitigate exploitation risk.