Executive brief
Sipeed PicoClaw is an AI assistant framework designed for efficient deployment on low-power hardware. A security flaw in its initial setup process allows unauthorized individuals to bypass network restrictions and take control of the administrative dashboard. If the software is running behind a local proxy or tunnel, an attacker can remotely set the administrator password, gaining full access to manage credentials and system configurations.
Technical details
An authentication bypass exists in the `web/backend/middleware/access_control.go` component of Sipeed PicoClaw. The middleware incorrectly prioritizes loopback addresses, unconditionally allowing any request where the `RemoteAddr` is a loopback IP, even when `allowed_cidrs` is configured. In environments where a same-host reverse proxy or TCP forwarder relays external traffic to the backend, the launcher identifies the traffic as local and skips CIDR enforcement. During the 'First Run Setup' phase, the `POST /api/auth/setup` endpoint does not require an existing session, allowing a remote attacker to set the initial administrative password and gain full control of the dashboard. The issue is addressed in commit 017601354be38cb027ff3ffb01aed79bd5d12610.
Affected products
- Sipeed PicoClaw up to 0.2.9
Timeline
- 2026-07-18: disclosed: Vulnerability reported via GitHub Issues
- 2026-07-18: patched: Fix committed to repository
- 2026-07-19: advisory: CVE published to NVD
References
- https://github.com/sipeed/picoclaw/
- https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610
- https://github.com/sipeed/picoclaw/issues/3080
- https://github.com/sipeed/picoclaw/pull/3083
- https://vuldb.com/cve/CVE-2026-16198
- https://vuldb.com/submit/852965
- https://vuldb.com/vuln/380014