PT-2026-60926 · Sipeed · Picoclaw

Eric-I · CVE-2026-16084 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0

Description An issue exists in the web fetch() function within the pkg/tools/integration/web.go file that allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This flaw enables remote exploitation.

Recommendations Deploy patch c15aac21fe05ee103a470e1104bc891754e83392 for versions prior to 0.3.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-16084

Affected Products

Picoclaw

References · 10

• 🔥 https://github.com/sipeed/picoclaw/issues/3074 · Exploit
• https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392 · Patch
• https://github.com/sipeed/picoclaw/pull/3143 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-16084 · Security Note
• https://vuldb.com/cve/CVE-2026-16084 · Note
• https://vuldb.com/submit/852946 · Note
• https://vuldb.com/vuln/379796/cti · Note
• https://vuldb.com/vuln/379796 · Note
• https://twitter.com/VulmonFeeds/status/2078430812635115562 · Twitter Post
• https://github.com/sipeed/picoclaw · Note