EUVD-2026-45357
GHSA-j6gf-86v7-wm22
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the temporal prerequisite of an uninitialized instance; successful CSRF registers admin credentials, warranting I:H despite no confidentiality or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 4b0229351678f479429b8d8b19207757266f246b. Applying a patch is advised to resolve this issue.
AnalysisAI
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at /api/auth/setup in web/backend/api/auth.go accepted POST requests without validating Origin, Referer, or Sec-Fetch-Site headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Technical ContextAI
Sipeed PicoClaw is a Go-based launcher application with a web backend, identified by CPE cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:* and referencing an OpenAI-compatible provider component. The CSRF root cause (CWE-352) is the absence of cross-origin validation on state-mutating POST endpoints during the first-run setup flow. The PR diff shows the fix introduces launcherSetupCrossSite(), which inspects Sec-Fetch-Site, Origin, and Referer headers against the server's own scheme and host before allowing the /api/auth/setup endpoint to proceed. Test code confirms the server binds to 127.0.0.1:18800 by default and that cross-site requests with mismatched origins are now rejected with HTTP 403.
RemediationAI
Apply the upstream fix from commit 4b0229351678f479429b8d8b19207757266f246b (https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b), which adds Origin/Referer/Sec-Fetch-Site validation to the setup endpoint. Verify that a post-0.2.9 tagged release exists and includes this commit before deploying, as only a PR/commit is confirmed, not a named release version. As an immediate compensating control, complete the initial PicoClaw password setup immediately after installation - once initialized, the exploitable unauthenticated setup endpoint condition is closed. If deferring setup is unavoidable, restrict access to the PicoClaw web interface (default port 18800) to localhost only via host-based firewall rules, preventing cross-origin browser requests from reaching the endpoint.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today