PT-2026-60923 · Sipeed · Picoclaw

Eric-I · CVE-2026-16081 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.2.10

Description An issue exists in an unknown function within the web/backend/api/auth.go file that allows remote attackers to perform cross-site request forgery (CSRF), a technique where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is authenticated.

Recommendations Apply patch 4b0229351678f479429b8d8b19207757266f246b to resolve the issue.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2026-16081

Affected Products

Picoclaw

References · 10

• 🔥 https://github.com/sipeed/picoclaw/issues/3072 · Exploit
• https://github.com/sipeed/picoclaw/pull/3160 · Patch
• https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-16081 · Security Note
• https://vuldb.com/submit/852943 · Note
• https://vuldb.com/vuln/379793/cti · Note
• https://twitter.com/VulmonFeeds/status/2078397501934059888 · Twitter Post
• https://vuldb.com/vuln/379793 · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/cve/CVE-2026-16081 · Note