# CVE-2026-16081: Sipeed PicoClaw CSRF in first-run password setup

Source: https://junglewise.ai/threats/cve-2026-16081-sipeed-picoclaw-csrf-in-first-run-password-setup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16081 · Severity: medium · CVSS 4.3 · Published 2026-07-18

Sipeed PicoClaw is an AI assistant and automation tool designed for efficient hardware deployment. A security flaw in its initial setup process allows a malicious website to remotely set the administrator password if the user has not yet configured it. This could allow an attacker to take control of the device's dashboard, modify configurations, and manage sensitive credentials.

Technologies: [Sipeed PicoClaw](https://junglewise.ai/threats/technologies/picoclaw). Vendors: [Sipeed](https://junglewise.ai/threats/vendors/sipeed).

## Quick answers

**Is CVE-2026-16081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16081 being exploited in the wild.

**How severe is CVE-2026-16081?** Medium severity, with a CVSS score of 4.3, published 18 July 2026.

**Which products and versions are affected?** Sipeed PicoClaw <= 0.2.9.

**Is there a fix for CVE-2026-16081?** A patch was published on 2026-07-18: Fix merged in commit 4b0229351678f479429b8d8b19207757266f246b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16081 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16081?** Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `handleSetup` function within `web/backend/api/auth.go` of Sipeed PicoClaw up to version 0.2.9. The application exposes a public bootstrap endpoint at `POST /api/auth/setup` intended for initial configuration; however, it fails to validate browser provenance headers such as Origin, Referer, or Sec-Fetch-Site. A remote attacker can lure a victim with an uninitialized PicoClaw instance to a malicious webpage, which then silently submits a request to the local launcher to set an attacker-controlled administrator password. This grants the attacker full access to the launcher dashboard, including gateway control and credential management. A patch has been developed (commit 4b02293) to reject cross-site setup requests.

## Affected products

- Sipeed PicoClaw <= 0.2.9

## Timeline

- 2026-07-18: disclosed: Vulnerability disclosed via GitHub Issue #3072
- 2026-07-18: advisory: NVD and VulDB publish advisory details
- 2026-07-18: patched: Fix merged in commit 4b0229351678f479429b8d8b19207757266f246b

## References

- [https://github.com/sipeed/picoclaw/](https://github.com/sipeed/picoclaw/)
- [https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b](https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b)
- [https://github.com/sipeed/picoclaw/issues/3072](https://github.com/sipeed/picoclaw/issues/3072)
- [https://github.com/sipeed/picoclaw/pull/3160](https://github.com/sipeed/picoclaw/pull/3160)
- [https://vuldb.com/cve/CVE-2026-16081](https://vuldb.com/cve/CVE-2026-16081)
- [https://vuldb.com/submit/852943](https://vuldb.com/submit/852943)
- [https://vuldb.com/vuln/379793](https://vuldb.com/vuln/379793)

## Related threats

- [Sipeed PicoClaw authentication bypass in First Run Setup](https://junglewise.ai/threats/cve-2026-16198-sipeed-picoclaw-authentication-bypass-in-first-run-setup)
- [Sipeed PicoClaw missing authorization in Feishu Group Message Handler](https://junglewise.ai/threats/cve-2026-16197-sipeed-picoclaw-missing-authorization-in-feishu-group-message)
- [Sipeed PicoClaw SSRF in web_fetch via special-use IPv4 bypass](https://junglewise.ai/threats/cve-2026-16196-sipeed-picoclaw-ssrf-in-web-fetch-via-special-use-ipv4-bypass)
- [Sipeed PicoClaw incorrect authorization in WeCom Group Message Handler](https://junglewise.ai/threats/cve-2026-16195-sipeed-picoclaw-incorrect-authorization-in-wecom-group-message)
- [Sipeed PicoClaw untrusted functionality inclusion in NewContextBuilder](https://junglewise.ai/threats/cve-2026-16085-sipeed-picoclaw-untrusted-functionality-inclusion-in)