Is CVE-2026-16200 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16200 being exploited in the wild.

How severe is CVE-2026-16200?

High severity, with a CVSS score of 7.3, published 19 July 2026.

Is there a fix for CVE-2026-16200?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16200 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-16200?

Check whether you run Zevorn Rt-Claw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16200: zevorn rt-claw incorrect authorization in RPC Handler

CVE-2026-16200 · Severity: high · CVSS 7.3 · Published 2026-07-19

zevorn rt-claw is an AI assistant framework. A security flaw in its communication system allows unauthorized remote users to bypass security restrictions and execute commands on the host system. This could lead to a complete takeover of the device running the software, potentially exposing sensitive data or allowing the device to be used in further attacks.

Technologies: Zevorn Rt-Claw. Vendors: Zevorn.

Quick answers

Is CVE-2026-16200 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16200 being exploited in the wild.
How severe is CVE-2026-16200?: High severity, with a CVSS score of 7.3, published 19 July 2026.
Which products and versions are affected?: Zevorn Rt-Claw up to 0.2.0.
Is there a fix for CVE-2026-16200?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16200 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-16200?: Check whether you run Zevorn Rt-Claw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability exists in the `claw_tool_invoke` function within `claw/services/swarm/swarm.c` of zevorn rt-claw. While the software includes a `CLAW_TOOL_LOCAL_ONLY` flag intended to prevent remote execution of sensitive tools, the RPC receiver path fails to validate this flag upon receiving inbound UDP requests. An unauthenticated remote attacker can send a crafted UDP swarm RPC request to the public listener (typically port 5300) to invoke the `run_script` tool. On Linux systems, this results in arbitrary Python code execution via `popen()`. As of the advisory date, no patch has been released by the vendor.

Affected products

zevorn rt-claw up to 0.2.0

Timeline

2026-07-19: disclosed: Public disclosure of the vulnerability and exploit details.
2026-07-19: advisory: NVD and VulDB published the advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.