CVE-2026-16128 describes a server-side request forgery vulnerability in zevorn rt-claw up to version 0.2.0. The issue resides in the receiver_thread function of claw/services/swarm/swarm.c in the http_request component. An attacker can remotely manipulate this function to induce the server to perform unauthorized requests. The vulnerability is publicly known, and an exploit has been released. No official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary HTTP requests. This may lead to unauthorized access to internal resources or services accessible from the server, potentially exposing sensitive information or enabling further attacks. The CVSS score of 6.9 indicates a medium severity impact with network attack vector and no privileges or user interaction required.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation, users should consider implementing network-level controls to restrict outbound requests from the affected component or isolate the vulnerable service until a patch is released. Monitor vendor advisories for updates and apply any future patches promptly.