Is there a public PoC exploit available for CVE-2026-16126?

Yes, a public proof-of-concept exploit is available for CVE-2026-16126. Prioritise patching immediately. EPSS: 0.3%.

rt-claw CVE-2026-16126

Q: What is the CVSS score of CVE-2026-16126?

CVE-2026-16126 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45387 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-18 VulDB

GHSA-8v54-v28q-c3mx

Authentication Bypass Rt Claw Zevorn

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible RPC, no credentials required due to authorization bypass, low partial impact across all three CIA pillars, no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 16:30 vuln.today

CVSS changed

Jul 18, 2026 - 16:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 18, 2026 - 15:45 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Incorrect authorization in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to bypass access controls in the Swarm RPC Receiver component, enabling unauthorized read, write, and availability impact against affected deployments. The flaw resides specifically in the handle_rpc_request function within claw/services/swarm/swarm.c, where authorization logic fails to correctly validate the calling actor. A publicly available proof-of-concept exploit exists, the project has not responded to responsible disclosure, and no patch has been released, leaving all installations on or below v0.2.0 without a vendor-provided fix.

Technical ContextAI

rt-claw (CPE: cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*) is an open-source project by the zevorn organization that implements a swarm coordination architecture with an RPC (Remote Procedure Call) interface. The vulnerable code path is the handle_rpc_request function in claw/services/swarm/swarm.c, the entry point for the Swarm RPC Receiver. CWE-863 (Incorrect Authorization) describes a class of flaws where the software performs an authorization check but the logic is flawed - the check does not correctly validate whether an actor has the required privilege or identity, allowing access that should be denied. This is distinct from missing authorization (CWE-862) in that a check exists but is implemented incorrectly, typically due to logical errors such as inverted conditions, insufficient scope validation, or trusting attacker-controlled data in the authorization decision.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project was notified via GitHub issue #135 but has not responded. Until a patch is released, operators should isolate the Swarm RPC Receiver port from untrusted networks using firewall rules or network ACLs, preventing unauthenticated remote actors from reaching the handle_rpc_request endpoint; this trade-off disables swarm coordination functionality for remote peers. If the swarm feature is not required, disabling or removing the Swarm RPC Receiver component entirely is the most effective compensating control. Organizations should monitor the GitHub repository at https://github.com/zevorn/rt-claw/ and VulDB entry https://vuldb.com/vuln/379838 for any upstream patch or fork that addresses the incorrect authorization logic. If a patched version is released, upgrade immediately given that exploit code is already publicly available.