CVE-2026-16128 is a server-side request forgery vulnerability in zevorn rt-claw up to version 0.2.0. It affects the receiver_thread function in claw/services/swarm/swarm.c, part of the http_request component. The vulnerability allows remote attackers to manipulate the server to perform unauthorized requests. Although the project was notified early, no remediation or patch has been issued. Public exploit code is available, increasing the risk of potential attacks. The CVSS 4.0 score is 6.9, reflecting a medium severity level with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary HTTP requests. This may lead to unauthorized internal network access or interaction with internal services not otherwise accessible. The vulnerability is remotely exploitable without authentication or user interaction. However, no confirmed exploitation in the wild has been reported to date.

No official fix or patch is currently available for this vulnerability. Since the vendor has not responded or provided remediation, users should consider implementing network-level protections such as restricting outbound HTTP requests from the affected service or isolating the vulnerable component until a patch is released. Monitor vendor advisories for updates regarding an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.