Executive brief
Sipeed PicoClaw is an AI assistant platform designed for efficient hardware. A security flaw in its network access control allows remote attackers to bypass IP address restrictions when the software is running behind a common web proxy. This could allow unauthorized individuals to access administrative setup pages or sensitive internal data that was intended to be private.
Technical details
The vulnerability exists in the IPAllowlist function within web/backend/middleware/access_control.go. The middleware identifies clients using r.RemoteAddr and automatically grants access if the address is a loopback IP (127.0.0.1). When PicoClaw is deployed behind a reverse proxy on the same host, all incoming remote traffic appears to originate from the loopback address, causing the middleware to skip CIDR allowlist checks. An unauthenticated remote attacker can exploit this to reach restricted endpoints, including /api/auth/setup, potentially allowing them to initialize the dashboard and take control of the instance. The issue is addressed in patch 3126.
Affected products
- Sipeed PicoClaw up to 0.2.9
Timeline
- 2026-06-15: patched: Pull request 3126 merged to address the bypass diagnostics
- 2026-07-10: disclosed: CVE-2026-15319 published