Server-Side Request Forgery in zevorn rt-claw HTTP Component

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-16125 is a server-side request forgery (SSRF) vulnerability in zevorn rt-claw versions up to 0.2.0, specifically within the http_request component's claw_net_get and claw_net_post functions. An attacker can manipulate the URL argument to force the vulnerable application to make arbitrary HTTP requests to internal or external systems on behalf of the server. This matters significantly because SSRF vulnerabilities enable attackers to access restricted resources, interact with internal services, scan internal networks, or pivot toward further compromise. While not yet in CISA's actively exploited vulnerabilities list, the public exploit availability increases risk. Organizations using rt-claw for HTTP operations—particularly those integrating it into security tools, orchestration platforms, or data processing pipelines—face immediate exposure. The CVSS score of 7.3 reflects the high severity of remote exploitation without authentication requirements.

Casky's 331 matching skills across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Credential Access) enable detection of the attack patterns underlying this vulnerability. Practitioners using Casky would see findings related to suspicious outbound HTTP requests originating from the application, unusual internal service discovery attempts, and attempts to access cloud metadata endpoints—hallmark indicators of SSRF exploitation. Claude's extended reasoning identifies chains where an attacker performs reconnaissance (TA0001) by probing which internal resources the server can reach, then potentially escalates to credential access (TA0006) by targeting credential stores, API endpoints, or internal authentication systems. Security teams would observe anomalous URL parameters in application logs, unexpected connections to internal IP ranges or private cloud metadata services (169.254.169.254), and HTTP requests to localhost or 127.0.0.1 as red flags indicating active SSRF exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16125.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-16125

Casky has 331 skills that investigate the attack patterns behind CVE-2026-16125. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn