Is CVE-2026-15319 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15319 being exploited in the wild.

How severe is CVE-2026-15319?

High severity, with a CVSS score of 7.3, published 10 July 2026.

Is there a fix for CVE-2026-15319?

A patch was published on 2026-06-15: Pull request 3126 merged to address the bypass diagnostics Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15319 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15319?

Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15319: Sipeed PicoClaw access control bypass in IPAllowlist middleware

CVE-2026-15319 · Severity: high · CVSS 7.3 · Published 2026-07-10

Sipeed PicoClaw is an AI assistant platform designed for efficient hardware. A security flaw in its network access control allows remote attackers to bypass IP address restrictions when the software is running behind a common web proxy. This could allow unauthorized individuals to access administrative setup pages or sensitive internal data that was intended to be private.

Technologies: Sipeed PicoClaw. Vendors: Sipeed.

Quick answers

Is CVE-2026-15319 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15319 being exploited in the wild.
How severe is CVE-2026-15319?: High severity, with a CVSS score of 7.3, published 10 July 2026.
Which products and versions are affected?: Sipeed PicoClaw up to 0.2.9.
Is there a fix for CVE-2026-15319?: A patch was published on 2026-06-15: Pull request 3126 merged to address the bypass diagnostics Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15319 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15319?: Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the IPAllowlist function within web/backend/middleware/access_control.go. The middleware identifies clients using r.RemoteAddr and automatically grants access if the address is a loopback IP (127.0.0.1). When PicoClaw is deployed behind a reverse proxy on the same host, all incoming remote traffic appears to originate from the loopback address, causing the middleware to skip CIDR allowlist checks. An unauthenticated remote attacker can exploit this to reach restricted endpoints, including /api/auth/setup, potentially allowing them to initialize the dashboard and take control of the instance. The issue is addressed in patch 3126.

Affected products

Sipeed PicoClaw up to 0.2.9

Timeline

2026-06-15: patched: Pull request 3126 merged to address the bypass diagnostics
2026-07-10: disclosed: CVE-2026-15319 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.