CVE-2026-16084: Server-Side Request Forgery in Sipeed PicoClaw
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
AI Analysis
Technical Summary
Sipeed PicoClaw up to version 0.2.9 contains a server-side request forgery vulnerability in the web_fetch function located in pkg/tools/integration/web.go. This flaw allows remote attackers to cause the server to make unintended requests, potentially leading to information disclosure or interaction with internal systems. The vulnerability is publicly known and an exploit has been released. A patch identified by commit c15aac21fe05ee103a470e1104bc891754e83392 is recommended to remediate the issue. No official remediation level or vendor advisory is currently provided.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery, which can lead to unauthorized internal network requests or data exposure. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low complexity and no required privileges or user interaction.
Mitigation Recommendations
A patch is recommended to fix this vulnerability, identified by commit c15aac21fe05ee103a470e1104bc891754e83392. Since no official vendor advisory or remediation level is provided, users should apply this patch or update to a fixed version once available. Monitor vendor channels for official updates.
CVE-2026-16084: Server-Side Request Forgery in Sipeed PicoClaw
Description
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
CVSS v4.0
Score 6.9medium
Affected software
cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Sipeed PicoClaw up to version 0.2.9 contains a server-side request forgery vulnerability in the web_fetch function located in pkg/tools/integration/web.go. This flaw allows remote attackers to cause the server to make unintended requests, potentially leading to information disclosure or interaction with internal systems. The vulnerability is publicly known and an exploit has been released. A patch identified by commit c15aac21fe05ee103a470e1104bc891754e83392 is recommended to remediate the issue. No official remediation level or vendor advisory is currently provided.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery, which can lead to unauthorized internal network requests or data exposure. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low complexity and no required privileges or user interaction.
Mitigation Recommendations
A patch is recommended to fix this vulnerability, identified by commit c15aac21fe05ee103a470e1104bc891754e83392. Since no official vendor advisory or remediation level is provided, users should apply this patch or update to a fixed version once available. Monitor vendor channels for official updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-17T13:50:07.157Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b5ea42d1edb114c7faea3
Added to database: 07/18/2026, 11:08:20 UTC
Last enriched: 07/18/2026, 11:22:51 UTC
Last updated: 07/18/2026, 12:55:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.