CVE-2026-16085
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A security vulnerability has been detected in Sipeed PicoClaw up to version 0.2.9, affecting the NewContextBuilder function in pkg/agent/context.go. The flaw allows inclusion of functionality from an untrusted control sphere, potentially leading to unauthorized actions. The attack requires local access, and the exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of local takeover of the PicoClaw agent, which could lead to privilege escalation or unauthorized code execution. The publicly available exploit increases the likelihood of exploitation by attackers with local access.
Recommendation
Immediately update Sipeed PicoClaw to a version newer than 0.2.9 if available. If no patch exists, restrict local access to the system and monitor logs for suspicious activity.
Other vulnerabilities in Sipeed PicoClaw
See all- CVE-2026-16198Medium
A vulnerability in Sipeed PicoClaw up to version 0.2.9 in the file web/backend/middleware/access_control.go allows authentication bypass by manipulating the allowed_cidrs argument. The attack is remote but requires high complexity and is difficult to exploit. The exploit is publicly available.
- CVE-2026-16197Medium
A security vulnerability was found in Sipeed PicoClaw up to version 0.2.9. The issue is in the handleMessageReceive function in the file pkg/channels/feishu/feishu_64.go of the Group Message Handler component, leading to missing authorization. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-16196Medium
A weakness in the web_fetch component of Sipeed PicoClaw up to version 0.2.9 allows server-side request forgery (SSRF). The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-16195Medium
A security flaw was discovered in Sipeed PicoClaw up to version 0.2.9 in the dispatchIncoming function of the file pkg/channels/wecom/wecom.go in the Group Message Handler component. The issue involves incorrect authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.
- CVE-2026-16084High
A server-side request forgery (SSRF) vulnerability has been identified in Sipeed PicoClaw up to version 0.2.9. The issue affects the web_fetch function in the file pkg/tools/integration/web.go. Remote exploitation is possible, and the exploit is publicly available.
- CVE-2026-16083Medium
A security flaw in Sipeed PicoClaw up to version 0.2.9 allows authentication bypass via capture-replay attack in the LINE Webhook component. The vulnerability affects the webhook.ParseRequest function in pkg/channels/line/line.go. Remote exploitation is possible, and a public exploit increases the risk.
- CVE-2026-16082Medium
Sipeed PicoClaw up to version 0.2.9 has a time-of-check time-of-use (TOCTOU) vulnerability in the ExecTool.executeRun function. A local attacker can exploit this to compromise data integrity.
- CVE-2026-16081Medium
A cross-site request forgery (CSRF) vulnerability was found in Sipeed PicoClaw up to version 0.2.9 in an unknown function of the file web/backend/api/auth.go. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-15320Medium
A vulnerability was found in Sipeed PicoClaw up to version 0.2.9, involving missing authorization in the rt.ReloadConfig function of the pkg/channels/pico/pico.go file. Manipulating the message.send argument allows remote exploitation. The exploit is publicly available.
- CVE-2026-15319High
A security vulnerability was found in Sipeed PicoClaw up to version 0.2.9 in the IPAllowlist function of the file web/backend/middleware/access_control.go in the Launcher component. This leads to improper access controls and can be exploited remotely. The exploit has been publicly disclosed and may be used in attacks.
Original NVD description (English source)
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.