CVE-2026-16198

Sipeed PicoClaw First Run Setup access_control.go authentication bypass

State: Published
Severity: 6.3 Medium
Published: Jul 18, 2026
Updated: Jul 21, 2026
Reserved: Jul 18, 2026

Description

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.6 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.6 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	5.1 Medium	AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-288 Authentication Bypass Using Alternate Channel
CWE-287 Improper Authentication

Affected Products

Product	Versions
PicoClawSipeed	0.2.0Affected 0.2.1Affected 0.2.2Affected 0.2.3Affected 0.2.4Affected 0.2.5Affected 0.2.6Affected 0.2.7Affected 0.2.8Affected 0.2.9Affected

References

VDB-380014 | Sipeed PicoClaw First Run Setup access_control.go authentication bypassvdb-entrytechnical-description
VDB-380014 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-16198 | CVE Analysis and Reportthird-party-advisory
Submit #852965 | Sipeed PicoClaw <= v0.2.9 Authentication Bypass Using an Alternate Path or Channel (CWE-288)third-party-advisory
https://github.com/sipeed/picoclaw/issues/3080exploitissue-tracking
https://github.com/sipeed/picoclaw/pull/3083issue-trackingpatch
https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610patch
https://github.com/sipeed/picoclaw/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.