Sipeed PicoClaw CVE-2026-16198

Q: What is the CVSS score of CVE-2026-16198?

CVE-2026-16198 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-45409 LOW

Improper Authentication (CWE-287)

2026-07-19 cna@vuldb.com

GHSA-367p-r6p3-qqmv

Authentication Bypass

2.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Network-reachable header injection (AV:N) requiring knowledge of proxy topology and allowed CIDRs (AC:H); no credentials needed (PR:N); impact limited to low-level First Run Setup access, no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 19, 2026 - 00:30 vuln.today

Analysis Generated

Jul 19, 2026 - 00:30 vuln.today

DescriptionCVE.org

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue.

AnalysisAI

IP allowlist bypass in Sipeed PicoClaw's First Run Setup middleware allows remote unauthenticated attackers to circumvent CIDR-based access controls by injecting a spoofed trusted IP address into the X-Forwarded-For header, exploiting the pre-patch logic that blindly trusted the leftmost header value without validating intermediate proxies. All versions through 0.2.9 are affected via the web/backend/middleware/access_control.go component. A public proof-of-concept is confirmed (CVSS 4.0 E:P), though high attack complexity and the narrow setup-phase window substantially limit real-world impact; no active exploitation has been confirmed in CISA KEV.

Technical ContextAI

The affected code is a Go HTTP middleware (web/backend/middleware/access_control.go) in the Sipeed PicoClaw web backend that enforces IP-based allowlisting during First Run Setup via the allowed_cidrs configuration argument. The pre-patch clientIPFromXForwardedFor function extracted only the leftmost IP from the X-Forwarded-For header chain without verifying that the relaying proxy fell within a configured TrustedProxyCIDRs range - a classic IP spoofing flaw in reverse-proxy deployments. CWE-287 (Improper Authentication) applies because this alternate channel (the HTTP forwarding header) undermines the authentication-equivalent IP restriction mechanism. The fix, introduced in commit 017601354be38cb027ff3ffb01aed79bd5d12610, replaces the leftmost-trust algorithm with a right-to-left walk of the header chain, returning the first IP not contained within trusted proxy networks - the correct industry-standard approach. The README addendum explicitly mandates that trusted-proxy deployments sanitize or overwrite X-Forwarded-For and X-Real-IP headers at the ingress layer. No CPE strings were supplied in the intelligence data.

RemediationAI

The primary remediation is to apply the upstream patch available at commit 017601354be38cb027ff3ffb01aed79bd5d12610 (https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610), also tracked in pull request https://github.com/sipeed/picoclaw/pull/3083. A formal tagged release version containing this fix has not been independently confirmed from the available references - verify against the upstream repository before deploying. Where immediate patching is not possible, configure the ingress reverse proxy to strip or sanitize X-Forwarded-For and X-Real-IP headers before they reach PicoClaw, preventing external injection of attacker-controlled IP values; note that this requires proxy-level access and may affect legitimate forwarded-IP logging. As an additional layer, restrict network access to the First Run Setup endpoint using a perimeter firewall to limit exposure to trusted administrative subnets - this eliminates the remote attack vector entirely but requires network-layer controls outside the application. Completing First Run Setup as quickly as possible after deployment reduces the window of exposure, since the vulnerable code path is associated with that setup phase.