Server-Side Request Forgery in zevorn rt-claw HTTP Handler

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-16127 represents a server-side request forgery (SSRF) vulnerability in zevorn rt-claw versions up to 0.2.0, specifically within the HTTP request handling functions claw_net_get and claw_net_post. The vulnerability allows remote attackers to manipulate the URL argument, enabling them to craft malicious requests that force the server to make unintended network calls to internal or external systems. This impacts any application or service using affected rt-claw versions for HTTP operations, potentially exposing internal networks, cloud metadata endpoints, and sensitive services. With a CVSS score of 7.3 and publicly available exploits, this vulnerability poses a significant risk to organizations relying on this component, particularly in containerized and cloud environments where SSRF attacks can pivot to metadata services or internal infrastructure.

Casky's 331 mapped security skills leverage Claude AI's extended reasoning to correlate attack patterns across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). When analyzing traffic or code execution patterns, practitioners would observe detection signals including: anomalous outbound HTTP requests to unexpected internal IP ranges or localhost services, URL parameter manipulation attempts targeting cloud metadata endpoints (169.254.169.254), and request patterns consistent with reconnaissance of internal APIs. The platform's skill-based approach enables detection of the reconnaissance phase (TA0001) where attackers probe available services, and the credential harvesting phase (TA0006) when SSRF chains to metadata services or authentication endpoints. Security teams using Casky would identify suspicious claw_net_* function calls with user-controlled URL parameters and flag requests attempting to access restricted internal resources as high-priority indicators of compromise or exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16127.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-16127

Casky has 331 skills that investigate the attack patterns behind CVE-2026-16127. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn