EUVD-2026-45357
GHSA-j6gf-86v7-wm22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim opens browser with PicoClaw uninitialized
-
DeliveryVictim visits attacker-controlled webpage
-
ExploitMalicious page POSTs forged setup JSON to localhost:18800
-
ExecutionUnguarded /api/auth/setup accepts cross-site request
-
PersistAttacker-controlled password registered as admin
-
ImpactAttacker authenticates and controls PicoClaw instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target PicoClaw instance is in an uninitialized first-run state - specifically, that no admin password has been set and the password store has not yet been initialized. This is confirmed by the patch test code, which verifies that |
| Impact | The vendor-assigned CVSS 4.0 score of 2.1 (VI:L) understates the practical impact: successfully forging the setup request registers an attacker-chosen admin password, which constitutes full application account takeover for the launcher, not merely a low-integrity write. However, the narrow exploitation window - the instance must be in an uninitialized, first-run state - meaningfully limits real-world risk. A publicly available exploit exists (E:P in the CVSS 4.0 supplemental vector), which elevates urgency for users mid-deployment. No EPSS data was provided, and the absence of a KEV listing is consistent with the niche product footprint. Overall risk priority is low-to-moderate: high impact if triggered during setup, but the condition is transient and easily eliminated by completing initial configuration. |
| Exploit ScenarioDerived | A user installs PicoClaw but has not yet completed the initial setup (password not configured). While their browser is open, they visit an attacker-controlled webpage that silently POSTs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at /api/auth/setup in web/backend/api/auth.go accepted POST requests without validating Origin, Referer, or Sec-Fetch-Site headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
RemediationAI
Apply the upstream fix from commit 4b0229351678f479429b8d8b19207757266f246b (https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b), which adds Origin/Referer/Sec-Fetch-Site validation to the setup endpoint. Verify that a post-0.2.9 tagged release exists and includes this commit before deploying, as only a PR/commit is confirmed, not a named release version. As an immediate compensating control, complete the initial PicoClaw password setup immediately after installation - once initialized, the exploitable unauthenticated setup endpoint condition is closed. If deferring setup is unavoidable, restrict access to the PicoClaw web interface (default port 18800) to localhost only via host-based firewall rules, preventing cross-origin browser requests from reaching the endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sipeed PicoClaw is a Go-based launcher application with a web backend, identified by CPE cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:* and referencing an OpenAI-compatible provider component. The CSRF root cause (CWE-352) is the absence of cross-origin validation on state-mutating POST endpoints during the first-run setup flow. The PR diff shows the fix introduces launcherSetupCrossSite(), which inspects Sec-Fetch-Site, Origin, and Referer headers against the server's own scheme and host before allowing the /api/auth/setup endpoint to proceed. Test code confirms the server binds to 127.0.0.1:18800 by default and that cross-site requests with mismatched origins are now rejected with HTTP 403.
Know when Picoclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
AC:H reflects the temporal prerequisite of an uninitialized instance; successful CSRF registers admin credentials, warranting I:H despite no confidentiality or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 4b0229351678f479429b8d8b19207757266f246b. Applying a patch is advised to resolve this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Exploit-DB