EUVD-2026-45389
GHSA-f2c6-8jg6-287f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with no authentication or interaction needed; limited low-impact read/write/availability on the vulnerable system only, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to forge arbitrary HTTP requests via the receiver_thread function within the swarm service's http_request component (claw/services/swarm/swarm.c). The CVSS 4.0 vector confirms fully remote, unauthenticated, low-complexity exploitation with no user interaction required. A public proof-of-concept exists via GitHub issue #140, and the vendor had not responded to the coordinated disclosure at the time of reporting - no patch is available.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes the root cause: the application accepts externally supplied input that controls the destination URL of a server-initiated HTTP request without adequate validation or allowlisting. The vulnerable code path is the receiver_thread function in claw/services/swarm/swarm.c, which is part of rt-claw's swarm orchestration service. The http_request component within this service processes user-controlled input and issues outbound requests on behalf of the server. This pattern is a classic SSRF surface: when user-supplied URLs are passed directly to an HTTP client, an attacker can redirect the server to internal endpoints, cloud metadata services (e.g., 169.254.169.254), or other network-adjacent resources that are inaccessible from the public internet. The CPE cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:* confirms all versions up to 0.2.0 are affected.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor had not responded to the disclosure as of the CVE report date, and no patched release is confirmed. Users should monitor the GitHub repository at https://github.com/zevorn/rt-claw/ for updates and the VulDB advisory at https://vuldb.com/vuln/379840 for status changes. As compensating controls: apply strict egress filtering on the host running rt-claw to restrict outbound HTTP connections to a known allowlist of legitimate destinations, blocking access to RFC 1918 private IP ranges and cloud instance metadata endpoints (e.g., 169.254.169.254, fd00::/8) - note this may disrupt intended swarm peer communication if internal addresses are legitimately required. If the swarm service is not operationally required, disable or firewall it entirely. Input validation enforcing URL scheme and host allowlisting within the http_request handler would be the definitive code-level mitigation until an official patch is released.
Information disclosure in zevorn's rt-claw (all versions up to 0.2.0) is reachable remotely through manipulation of the
Incorrect authorization in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to bypass access c
Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privile
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows unauthenticated remote attackers to manipulate
Server-side request forgery in rt-claw up to 0.2.0 allows unauthenticated remote attackers to manipulate the `url` argum
Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today