CVE-2026-16198 describes an authentication bypass vulnerability in Sipeed PicoClaw versions prior to 0.2.10. The vulnerability arises from improper handling of the allowed_cidrs argument in the access control middleware during the first run setup process. This flaw enables an attacker to bypass authentication using an alternate channel remotely. The attack complexity is high and exploitability is difficult. Although the exploit is public, no known exploits in the wild have been reported. A patch is available and should be applied to remediate the issue.

Successful exploitation results in authentication bypass, potentially allowing unauthorized access to the affected system. The impact is rated low severity due to the high complexity and difficulty of exploitation, as well as limited exploitability. No known active exploitation has been reported.

A patch identified by commit 017601354be38cb027ff3ffb01aed79bd5d12610 is available and applying it is the recommended remediation. No vendor advisory was provided to indicate otherwise. Organizations using affected versions should update to version 0.2.10 or later to mitigate this vulnerability.