CVE-2026-15318 is an authorization weakness in Sipeed PicoClaw up to version 0.2.9. The vulnerability exists in the MQTT Channel Handler component, specifically in the handling of the client_id argument within pkg/channels/mqtt/mqtt.go. This flaw allows remote attackers to manipulate client_id values to bypass authorization checks, potentially gaining unauthorized access or privileges. The vulnerability has been publicly disclosed, but no official fix or patch has been released. The reported GitHub issue was closed without resolution due to inactivity.

The vulnerability allows remote attackers to bypass authorization mechanisms by manipulating the client_id argument in the MQTT Channel Handler. This could lead to unauthorized access or actions within the affected system. The CVSS 4.0 score of 5.3 indicates a medium impact, reflecting limited privileges required and low complexity of attack but with some impact on confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published and the vendor has not provided remediation details, users should monitor for updates from Sipeed. Until a fix is available, consider restricting network access to the MQTT service or implementing additional access controls to mitigate unauthorized client_id manipulation.