CVE-2026-16084 - Vulnerability Details

- Sipeed PicoClaw web.go web_fetch server-side request forgery

Description

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.

Published: 2026-07-18

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A weakness in the web_fetch function of Sipeed PicoClaw’s pkg/tools/integration/web.go allows an attacker to provoke the device to send HTTP requests to arbitrary targets. This exploitation can reveal internal services, exfiltrate data, or launch further attacks from the compromised device. The flaw is a form of input validation error, categorized as CWE‑918.

Affected Systems

All PicoClaw devices running firmware version 0.2.9 or earlier are affected. The vulnerability is exposed through the publicly reachable web interface; any installation that has not yet applied the patch identified in commit c15aac21fe05ee103a470e1104bc891754e83392 remains vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate‑to‑high severity, while the EPSS score of less than 1 % points to a low current exploitation likelihood. The issue is not listed in the CISA KEV catalog. Remote exploitation is feasible via the device’s web interface, requiring only network connectivity to the PicoClaw. Organizations should prioritize patch deployment to mitigate this SSRF risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Sipeed

PicoClaw

affected

Version	Status	Constraints
`0.2.0`	affected	—
`0.2.1`	affected	—
`0.2.2`	affected	—
`0.2.3`	affected	—
`0.2.4`	affected	—
`0.2.5`	affected	—
`0.2.6`	affected	—
`0.2.7`	affected	—
`0.2.8`	affected	—
`0.2.9`	affected	—

No data.

Vendor Product Confidence Versions

Sipeed

Picoclaw

95%

Version	Status	Scheme	Platform
`0.2.0`	affected	semver	—
`0.2.1`	affected	semver	—
`0.2.2`	affected	semver	—
`0.2.3`	affected	semver	—
`0.2.4`	affected	semver	—
`0.2.5`	affected	semver	—
`0.2.6`	affected	semver	—
`0.2.7`	affected	semver	—
`0.2.8`	affected	semver	—
`0.2.9`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the PicoClaw firmware update or patch commit c15aac21fe05ee103a470e1104bc891754e83392 to remove the vulnerable web_fetch functionality.
Limit external access to the device’s web interface, or place the PicoClaw behind a firewall that blocks outbound traffic to untrusted destinations.
If the patch cannot be applied immediately, disable or isolate the web_fetch endpoint until the device is updated to a secure firmware version.

Generated by OpenCVE AI on July 30, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00401.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/sipeed/picoclaw/
https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392
https://github.com/sipeed/picoclaw/issues/3074
https://github.com/sipeed/picoclaw/pull/3143
https://vuldb.com/cve/CVE-2026-16084
https://vuldb.com/submit/852946
https://vuldb.com/vuln/379796
https://vuldb.com/vuln/379796/cti

History

Tue, 21 Jul 2026 03:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sat, 18 Jul 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
Title		Sipeed PicoClaw web.go web_fetch server-side request forgery
First Time appeared		Sipeed Sipeed picoclaw
Weaknesses		CWE-918
CPEs		cpe:2.3:a:sipeed:picoclaw::::::::
Vendors & Products		Sipeed Sipeed picoclaw
References		https://github.com/sipeed/picoclaw/ https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392 https://github.com/sipeed/picoclaw/issues/3074 https://github.com/sipeed/picoclaw/pull/3143 https://vuldb.com/cve/CVE-2026-16084 https://vuldb.com/submit/852946 https://vuldb.com/vuln/379796 https://vuldb.com/vuln/379796/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Sipeed Picoclaw

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-07-18T09:00:10.981Z

Updated: 2026-07-21T02:28:05.666Z

Reserved: 2026-07-17T13:50:07.157Z

Link: CVE-2026-16084

Vulnrichment

Updated: 2026-07-21T02:28:00.767Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-30T23:15:06Z

Weaknesses

CWE-918
Server-Side Request Forgery (SSRF)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object