EUVD-2026-45367
GHSA-mcj8-ff8h-86ph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify accessible PicoClaw web_fetch endpoint
-
DeliveryCraft ISATAP IPv6 URL embedding private IPv4
-
ExploitSubmit crafted URL to web_fetch API
-
ExecutionServer evaluates URL, SSRF guard bypassed
-
PersistServer issues HTTP request to internal/private target
-
ImpactAttacker receives internal resource response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The |
| Impact | The CVSS 4.0 base score of 5.5 with AV:N/AC:L/AT:N/PR:N/UI:N reflects unauthenticated network exploitation with no attack prerequisites beyond knowing the ISATAP bypass technique, with low impact across confidentiality, integrity, and availability of the vulnerable system. EPSS data was not provided in source intelligence. No CISA KEV listing exists, so active mass exploitation is not confirmed. However, the E:P modifier in the CVSS 4.0 supplemental vector confirms publicly available exploit code, which elevates practical urgency. Real-world risk is heavily deployment-dependent: in cloud environments where the PicoClaw server can reach internal metadata endpoints such as the AWS IMDS (169.254.169.254) or internal APIs, SSRF impact substantially exceeds what the numeric score conveys, potentially yielding IAM credentials or sensitive configuration data. In isolated or air-gapped deployments, risk is considerably lower. The ISATAP bypass technique, while not trivial, is documented and the public exploit lowers the attacker skill threshold. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to PicoClaw's web fetch endpoint supplying the URL |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in pkg/utils/http_guard.go fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as http://[2001:db8::5efe:127.0.0.1]. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.
RemediationAI
Apply the upstream fix from commit c15aac21fe05ee103a470e1104bc891754e83392, available via GitHub PR #3143 at https://github.com/sipeed/picoclaw/pull/3143. The patch extends IsPrivateOrRestrictedIP in pkg/utils/http_guard.go to detect ISATAP-formatted IPv6 addresses and check their embedded IPv4 component against the private-address blocklist. No specific patched release version number is confirmed from available data; verify against the project's releases page at https://github.com/sipeed/picoclaw/ before deploying. If immediate patching is not feasible, restrict network egress from the PicoClaw host at the firewall or network policy layer to deny outbound connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and loopback (127.0.0.0/8); note this may partially impact legitimate web fetch functionality if any internal resources are intentionally fetched. Additionally, disabling the web_fetch tool integration entirely eliminates the attack surface if that capability is not required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-918 (Server-Side Request Forgery) arises when an application fetches attacker-controlled URLs without fully validating the resolved destination. PicoClaw's web_fetch function in pkg/tools/integration/web.go provides a URL-fetching capability, likely for AI agent tool integration. The application maintains an SSRF guard in pkg/utils/http_guard.go via IsPrivateOrRestrictedIP, which blocked direct private IPv4 addresses but missed ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) IPv6 encoding. ISATAP embeds a 32-bit IPv4 address in bytes 12-15 of an IPv6 address, preceded by the interface identifier 00:00:5e:fe or 02:00:5e:fe (bytes 8-11). The upstream patch (commit c15aac21fe05ee103a470e1104bc891754e83392, PR #3143) adds detection for both ISATAP variants and recursively evaluates the extracted IPv4 against the existing private-address blocklist. Affected CPE: cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*.
Know when Picoclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible unauthenticated endpoint (AV:N/PR:N); scope changes as server fetches out-of-bounds resources (S:C); no demonstrated availability impact (A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Exploit-DB