EUVD-2026-45388
GHSA-3mc6-pq7x-jqgv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network unauthenticated with no user interaction; scope changed (S:C) because SSRF by definition causes the server to interact with systems beyond its own trust boundary.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows unauthenticated remote attackers to manipulate the url argument passed to the claw_net_get and claw_net_post functions in claw/tools/tool_net.c, causing the server to initiate arbitrary outbound HTTP requests. This can be leveraged to probe internal network resources, bypass perimeter controls, or interact with backend services not otherwise exposed. No public exploit identified at time of analysis beyond publicly available exploit code, and the vendor has not responded to the coordinated disclosure made via GitHub issue #139.
Technical ContextAI
rt-claw (CPE: cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*) is a project by zevorn that includes an HTTP request abstraction layer in claw/tools/tool_net.c. The functions claw_net_get and claw_net_post accept a url parameter as part of the http_request component and do not appear to validate or restrict the target destination of outbound requests. CWE-918 (Server-Side Request Forgery) describes exactly this class of flaw: when user-controlled data is used to construct an outbound request without allowlist validation of the target host or scheme, an attacker can redirect server-originated requests to arbitrary internal or external destinations. This is a classic input validation failure at the network-request boundary.
RemediationAI
No vendor-released patch identified at time of analysis - the project maintainer had not responded to the disclosure as of the report date. As a primary compensating control, restrict network egress from any host running rt-claw to only explicitly required external hosts and ports, effectively neutering SSRF by preventing arbitrary outbound connections. If running in a cloud environment, enforce IMDSv2 and block access to 169.254.169.254 at the host or VPC level to prevent credential theft via metadata service SSRF. Additionally, place rt-claw behind an API gateway or reverse proxy that enforces input validation on URL parameters before they reach the application. If the http_request functionality is not required, disable or remove the claw_net_get/claw_net_post code paths entirely. Consumers of this library should implement their own allowlist validation of the url argument prior to passing it to the affected functions. Monitor the GitHub repository at https://github.com/zevorn/rt-claw/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-16127 for patch availability.
Information disclosure in zevorn's rt-claw (all versions up to 0.2.0) is reachable remotely through manipulation of the
Incorrect authorization in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to bypass access c
Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privile
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to forge arbit
Server-side request forgery in rt-claw up to 0.2.0 allows unauthenticated remote attackers to manipulate the `url` argum
Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today