CVE-2026-16201: rt-claw Information Disclosure Vulnerability

CVE-2026-16201 Overview

CVE-2026-16201 is an information disclosure vulnerability affecting zevorn rt-claw versions up to 0.2.0. The flaw resides in the claw_net_get and claw_net_post functions within claw/services/tools/net.c, part of the http_request component. Attackers can trigger the weakness remotely across the network without authentication or user interaction. The exploit has been publicly disclosed. The project maintainer was notified through an issue report but has not responded at the time of publication.

Critical Impact
Remote unauthenticated attackers can extract sensitive information from applications built on rt-claw through crafted HTTP request interactions, exposing data that should remain confidential.

Affected Products

zevorn rt-claw versions up to and including 0.2.0
Applications embedding the http_request component from rt-claw
Downstream projects depending on claw/services/tools/net.c

Discovery Timeline

2026-07-19 - CVE-2026-16201 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16201

Vulnerability Analysis

The vulnerability is classified as an information disclosure issue mapped to [CWE-200]. The defect lies in the HTTP request handling routines claw_net_get and claw_net_post inside claw/services/tools/net.c. Manipulation of the request parameters causes the component to expose data that should be restricted from remote callers. Because the affected functions handle outbound HTTP interactions, any information returned or logged by these paths becomes reachable by an attacker capable of influencing request inputs. The exploit is public, which raises the likelihood of opportunistic use against exposed deployments.

Root Cause

The root cause is improper handling of data within the HTTP GET and POST helper functions. The functions do not adequately restrict or sanitize the response or state information returned to callers. Sensitive fields that should remain internal to the process can be surfaced when the request path is manipulated. The maintainer has not published a patch, so the exact code-level fix is not yet defined.

Attack Vector

Attackers exploit CVE-2026-16201 remotely over the network. No privileges or user interaction are required. The attacker crafts input to reach claw_net_get or claw_net_post execution paths and observes disclosed information in the response, error output, or side-channel state. The vulnerability produces confidentiality impact only, with no integrity or availability effects. Detailed exploit steps are documented in the VulDB Vulnerability Details and the GitHub Issue Discussion.

No verified proof-of-concept code is reproduced here. Refer to the GitHub Project Repository and the VulDB CVE Report for source-level context.

Detection Methods for CVE-2026-16201

Indicators of Compromise

Unexpected outbound HTTP GET or POST requests originating from applications linked against rt-claw versions <= 0.2.0.
Verbose error responses or debug output containing internal buffers, memory contents, or configuration values returned to remote clients.
Repeated probing of endpoints backed by claw_net_get or claw_net_post from a single source address.

Detection Strategies

Perform software composition analysis to identify projects that bundle zevorn rt-claw up to 0.2.0.
Inspect network telemetry for anomalous response sizes or content patterns from services using the http_request component.
Apply signature-based network monitoring for known exploit request patterns documented in the VulDB Vulnerability CTI.

Monitoring Recommendations

Log all HTTP transactions handled by claw_net_get and claw_net_post with request and response metadata for later review.
Alert on high-volume access to endpoints that invoke the affected functions.
Correlate application logs with egress network flows to spot data exfiltration attempts tied to this component.

How to Mitigate CVE-2026-16201

Immediate Actions Required

Inventory all deployments containing zevorn rt-claw at version 0.2.0 or earlier.
Restrict network exposure of services using the http_request component to trusted networks until a fix is available.
Subscribe to the GitHub Issue Discussion for status updates from the maintainer.

Patch Information

No official patch is available at the time of publication. The project was notified through an issue report but has not responded. Track the GitHub Project Repository for future releases and monitor the VulDB CVE Report for updates on remediation.

Workarounds

Place affected services behind a reverse proxy that filters or normalizes requests to the claw_net_get and claw_net_post endpoints.
Disable or remove the http_request component in builds where it is not required.
Apply strict input validation at the application boundary before requests reach claw/services/tools/net.c.
Limit outbound response verbosity so that only expected fields are returned to remote callers.

bash

# Configuration example: block external access to affected endpoints at the proxy layer
# Replace with the actual paths exposed by your rt-claw integration
iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string "/claw_net_get" -j DROP
iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string "/claw_net_post" -j DROP