The vulnerability CVE-2026-16201 affects the zevorn rt-claw project up to version 0.2.0. It resides in the claw_net_get and claw_net_post functions of the claw/services/tools/net.c file, part of the http_request component. This flaw allows remote attackers to cause information disclosure. The issue was reported early to the project but no response or fix has been issued. The CVSS 4.0 base score is 6.9 (medium severity), with an attack vector of network, low complexity, no privileges or user interaction required, and limited impact on confidentiality only.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected system. The impact is limited to confidentiality with no integrity or availability effects reported. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk profile. However, no known active exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service or applying other environment-specific mitigations to limit exposure.