Is there a public PoC exploit available for CVE-2026-16200?

Yes, a public proof-of-concept exploit is available for CVE-2026-16200. Prioritise patching immediately. EPSS: 0.3%.

rt-claw CVE-2026-16200

Q: What is the CVSS score of CVE-2026-16200?

CVE-2026-16200 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45411 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-19 VulDB

GHSA-9869-2292-xxj6

Authentication Bypass Rt Claw Zevorn

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable RPC with no authentication required (PR:N, AV:N, AC:L); scope unchanged and impact uniformly low per CVSS 4.0 VC/VI/VA:L mapping.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 19, 2026 - 01:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 19, 2026 - 01:13 vuln.today

CVE Published

Jul 19, 2026 - 00:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privileged RPC functions without valid credentials. The flaw resides in the claw_tool_invoke function within the swarm service RPC Handler (claw/services/swarm/swarm.c), where authorization checks are insufficiently enforced, enabling authentication bypass. A publicly available proof-of-concept exploit exists via GitHub issue #133; no patch has been released and the project maintainer has not responded to the disclosure.

Technical ContextAI

rt-claw (CPE: cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*) is an open-source project by zevorn, affected through version 0.2.0. The vulnerable component is the RPC Handler within the swarm service, implemented in claw/services/swarm/swarm.c. The root cause is CWE-863 (Incorrect Authorization), a class of flaw where a system incorrectly verifies whether a requestor has the necessary permissions to perform an operation - distinct from missing authentication (CWE-306) in that an authorization layer exists but applies checks incorrectly or incompletely. In this context, the claw_tool_invoke function processes remote procedure calls without properly validating the caller's authorization level, allowing any network-accessible caller to trigger privileged swarm tool invocations.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer was notified via issue report but has not responded. As an immediate compensating control, restrict network access to the rt-claw swarm RPC service using firewall rules or network segmentation so that only trusted hosts can reach the RPC handler port - this directly addresses the AV:N attack vector and eliminates remote exploitability without requiring code changes, though it does not fix the underlying flaw. If the swarm service component is not required for the deployment, disabling it entirely removes the attack surface with no functional trade-off for environments that don't use swarm functionality. Organizations should monitor the upstream repository at https://github.com/zevorn/rt-claw/ and VulDB entry https://vuldb.com/vuln/380016 for any patch release, and apply it immediately when available. Given the lack of maintainer response, consider forking or replacing the dependency if a fix is not forthcoming.