CVE-2026-16196: Server-Side Request Forgery in Sipeed PicoClaw
CVE-2026-16196 is a server-side request forgery (SSRF) vulnerability in Sipeed PicoClaw versions 0.2.0 through 0.2.9. The issue exists in the isPrivateOrRestrictedIP function within the web_fetch component, allowing remote attackers to manipulate requests. The vulnerability has a medium severity with a CVSS score of 5.3. A patch has been identified but no official remediation level or patch link is provided in the data. Users are advised to deploy the patch referenced by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 to mitigate the risk.
AI Analysis
Technical Summary
A server-side request forgery vulnerability (CVE-2026-16196) affects Sipeed PicoClaw up to version 0.2.9. The flaw is located in the isPrivateOrRestrictedIP function of the pkg/tools/integration/web.go file in the web_fetch component. This vulnerability allows remote attackers to manipulate server requests, potentially causing unauthorized internal network interactions. The vulnerability is publicly known and a patch is recommended, identified by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. No official vendor advisory or remediation level is provided, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery, which can lead to unauthorized internal network requests or data exposure within the affected system. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with low attack complexity and no user interaction required. The vulnerability could allow attackers to bypass network restrictions or access internal resources indirectly through the vulnerable server.
Mitigation Recommendations
A patch addressing this vulnerability is available, referenced by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. It is recommended to apply this patch to affected versions 0.2.0 through 0.2.9 of Sipeed PicoClaw. Since no official vendor advisory or remediation level is provided, users should verify patch applicability and monitor vendor channels for further updates. Patch status is not yet confirmed by the vendor advisory; check the vendor advisory for current remediation guidance.
CVE-2026-16196: Server-Side Request Forgery in Sipeed PicoClaw
Description
CVE-2026-16196 is a server-side request forgery (SSRF) vulnerability in Sipeed PicoClaw versions 0.2.0 through 0.2.9. The issue exists in the isPrivateOrRestrictedIP function within the web_fetch component, allowing remote attackers to manipulate requests. The vulnerability has a medium severity with a CVSS score of 5.3. A patch has been identified but no official remediation level or patch link is provided in the data. Users are advised to deploy the patch referenced by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 to mitigate the risk.
CVSS v4.0
Score 5.3medium
Affected software
pkg:golang/github.com/sipeed/picoclawcpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A server-side request forgery vulnerability (CVE-2026-16196) affects Sipeed PicoClaw up to version 0.2.9. The flaw is located in the isPrivateOrRestrictedIP function of the pkg/tools/integration/web.go file in the web_fetch component. This vulnerability allows remote attackers to manipulate server requests, potentially causing unauthorized internal network interactions. The vulnerability is publicly known and a patch is recommended, identified by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. No official vendor advisory or remediation level is provided, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery, which can lead to unauthorized internal network requests or data exposure within the affected system. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with low attack complexity and no user interaction required. The vulnerability could allow attackers to bypass network restrictions or access internal resources indirectly through the vulnerable server.
Mitigation Recommendations
A patch addressing this vulnerability is available, referenced by commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405. It is recommended to apply this patch to affected versions 0.2.0 through 0.2.9 of Sipeed PicoClaw. Since no official vendor advisory or remediation level is provided, users should verify patch applicability and monitor vendor channels for further updates. Patch status is not yet confirmed by the vendor advisory; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-18T07:22:33.012Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5c08532a4a8d5989708329
Added to database: 07/18/2026, 23:12:19 UTC
Last enriched: 07/18/2026, 23:26:54 UTC
Last updated: 07/19/2026, 02:36:46 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.