Is CVE-2026-16201 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16201 being exploited in the wild.

How severe is CVE-2026-16201?

Medium severity, with a CVSS score of 5.3, published 19 July 2026.

Is there a fix for CVE-2026-16201?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16201 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16201?

Check whether you run Zevorn Rt-Claw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16201: zevorn rt-claw information disclosure in http_request tool

CVE-2026-16201 · Severity: medium · CVSS 5.3 · Published 2026-07-19

A vulnerability exists in rt-claw, a toolset for AI assistants, that allows attackers to read sensitive files from the server. By providing a specially crafted URL to the application's network request tool, an attacker can bypass intended restrictions and access local system files like configuration data or credentials. This could lead to the exposure of private information and further compromise of the system.

Technologies: Zevorn Rt-Claw. Vendors: Zevorn.

Quick answers

Is CVE-2026-16201 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16201 being exploited in the wild.
How severe is CVE-2026-16201?: Medium severity, with a CVSS score of 5.3, published 19 July 2026.
Which products and versions are affected?: Zevorn Rt-Claw up to 0.2.0.
Is there a fix for CVE-2026-16201?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16201 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16201?: Check whether you run Zevorn Rt-Claw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The http_request tool in rt-claw (specifically within claw/services/tools/net.c) fails to validate the URL scheme of user-provided input before passing it to the underlying network library (libcurl on Linux). Because the application does not enforce an allowlist of protocols (e.g., http:// or https://), an attacker can use the file:// scheme to perform a local file disclosure. The vulnerability is reachable via the claw_net_get and claw_net_post functions. A remote attacker influencing AI tool arguments can cause the process to read local files and return their contents in the tool's response body. As of the advisory date, no official patch has been released by the vendor.

Affected products

zevorn rt-claw up to 0.2.0

Timeline

2026-07-18: disclosed: Issue reported to the project maintainers via GitHub.
2026-07-19: advisory: Vulnerability published in NVD/VulDB.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.