Executive brief
A security vulnerability exists in rt-claw, an AI assistant framework, specifically within its Swarm RPC communication component. An unauthorized remote attacker can send specially crafted network packets to bypass security checks and execute commands that are supposed to be restricted to local users only. This allows an attacker to remotely modify, read, or delete the AI's long-term memory, potentially poisoning the assistant's future behavior or accessing stored information.
Technical details
An authorization bypass vulnerability exists in the `handle_rpc_request` function within `claw/services/swarm/swarm.c` of zevorn rt-claw. While the outbound `swarm_rpc_call` helper enforces the `CLAW_TOOL_LOCAL_ONLY` flag, the inbound RPC receiver path fails to validate this flag before calling `claw_tool_invoke`. A remote, unauthenticated attacker can send crafted UDP packets to port 5300 to invoke restricted tools such as `save_memory`, `list_memories`, and `delete_memory`. This allows for persistent data injection into the AI's long-term memory (LTM) and unauthorized access to stored context. As of the advisory date, no official patch has been released by the vendor.
Affected products
- zevorn rt-claw up to 0.2.0
Timeline
- 2026-06-11: other: Vulnerability verified by researcher via PoC
- 2026-07-18: disclosed: Public disclosure of the vulnerability and PoC
- 2026-07-18: advisory: CVE-2026-16126 published