# CVE-2026-15317: Sipeed PicoClaw SSRF bypass in Guarded Web Fetch Flow

Source: https://junglewise.ai/threats/cve-2026-15317-sipeed-picoclaw-ssrf-bypass-in-guarded-web-fetch-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-15317 · Severity: medium · CVSS 6.3 · Published 2026-07-10

Sipeed PicoClaw, an AI assistant automation tool, contains a security flaw in its web fetching component. When the software is configured to use a network proxy, an attacker can trick the assistant into accessing internal company websites or sensitive local data that should be restricted. This could lead to the exposure of private internal information or unauthorized access to internal services.

Technologies: [Sipeed PicoClaw](https://junglewise.ai/threats/technologies/picoclaw). Vendors: [Sipeed](https://junglewise.ai/threats/vendors/sipeed).

## Quick answers

**Is CVE-2026-15317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15317 being exploited in the wild.

**How severe is CVE-2026-15317?** Medium severity, with a CVSS score of 6.3, published 10 July 2026.

**Which products and versions are affected?** Sipeed PicoClaw up to 0.2.9.

**Is there a fix for CVE-2026-15317?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15317 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15317?** Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the WebFetchTool.Execute function within pkg/tools/integration/web.go. The 'Guarded Web Fetch Flow' fails to properly validate destination URLs when the PicoClaw process is started with environment proxy variables (e.g., HTTP_PROXY) and the internal 'tools.web.proxy' setting is empty. While the tool implements a safe dialer to block private IP ranges, it allow-lists the proxy as a 'first hop.' In proxy mode, the Go HTTP client sends the full attacker-controlled URL to the proxy, which then performs the connection to the internal target on behalf of the application, effectively bypassing the SSRF protections. Attackers can exploit this via prompt injection or untrusted task input to retrieve content from internal-only resources.

## Affected products

- Sipeed PicoClaw up to 0.2.9

## Timeline

- 2026-07-10: advisory: NVD publication date
- 2026-06-05: disclosed: Date mentioned in PoC evidence logs

## References

- [https://github.com/sipeed/picoclaw/](https://github.com/sipeed/picoclaw/)
- [https://github.com/sipeed/picoclaw/issues/3078](https://github.com/sipeed/picoclaw/issues/3078)
- [https://vuldb.com/cve/CVE-2026-15317](https://vuldb.com/cve/CVE-2026-15317)
- [https://vuldb.com/submit/852877](https://vuldb.com/submit/852877)
- [https://vuldb.com/vuln/377257](https://vuldb.com/vuln/377257)
- [https://vuldb.com/vuln/377257/cti](https://vuldb.com/vuln/377257/cti)

## Related threats

- [Sipeed PicoClaw authentication bypass in First Run Setup](https://junglewise.ai/threats/cve-2026-16198-sipeed-picoclaw-authentication-bypass-in-first-run-setup)
- [Sipeed PicoClaw missing authorization in Feishu Group Message Handler](https://junglewise.ai/threats/cve-2026-16197-sipeed-picoclaw-missing-authorization-in-feishu-group-message)
- [Sipeed PicoClaw SSRF in web_fetch via special-use IPv4 bypass](https://junglewise.ai/threats/cve-2026-16196-sipeed-picoclaw-ssrf-in-web-fetch-via-special-use-ipv4-bypass)
- [Sipeed PicoClaw incorrect authorization in WeCom Group Message Handler](https://junglewise.ai/threats/cve-2026-16195-sipeed-picoclaw-incorrect-authorization-in-wecom-group-message)
- [Sipeed PicoClaw untrusted functionality inclusion in NewContextBuilder](https://junglewise.ai/threats/cve-2026-16085-sipeed-picoclaw-untrusted-functionality-inclusion-in)