# CVE-2026-16198: Sipeed PicoClaw authentication bypass in First Run Setup

Source: https://junglewise.ai/threats/cve-2026-16198-sipeed-picoclaw-authentication-bypass-in-first-run-setup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-07-19  
License: CC BY 4.0 with a link back

CVE-2026-16198 · Severity: medium · CVSS 5.6 · Published 2026-07-19

Sipeed PicoClaw is an AI assistant framework designed for efficient deployment on low-power hardware. A security flaw in its initial setup process allows unauthorized individuals to bypass network restrictions and take control of the administrative dashboard. If the software is running behind a local proxy or tunnel, an attacker can remotely set the administrator password, gaining full access to manage credentials and system configurations.

Technologies: [Sipeed PicoClaw](https://junglewise.ai/threats/technologies/picoclaw). Vendors: [Sipeed](https://junglewise.ai/threats/vendors/sipeed).

## Quick answers

**Is CVE-2026-16198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16198 being exploited in the wild.

**How severe is CVE-2026-16198?** Medium severity, with a CVSS score of 5.6, published 19 July 2026.

**Which products and versions are affected?** Sipeed PicoClaw up to 0.2.9.

**Is there a fix for CVE-2026-16198?** A patch was published on 2026-07-18: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16198 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16198?** Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass exists in the `web/backend/middleware/access_control.go` component of Sipeed PicoClaw. The middleware incorrectly prioritizes loopback addresses, unconditionally allowing any request where the `RemoteAddr` is a loopback IP, even when `allowed_cidrs` is configured. In environments where a same-host reverse proxy or TCP forwarder relays external traffic to the backend, the launcher identifies the traffic as local and skips CIDR enforcement. During the 'First Run Setup' phase, the `POST /api/auth/setup` endpoint does not require an existing session, allowing a remote attacker to set the initial administrative password and gain full control of the dashboard. The issue is addressed in commit 017601354be38cb027ff3ffb01aed79bd5d12610.

## Affected products

- Sipeed PicoClaw up to 0.2.9

## Timeline

- 2026-07-18: disclosed: Vulnerability reported via GitHub Issues
- 2026-07-18: patched: Fix committed to repository
- 2026-07-19: advisory: CVE published to NVD

## References

- [https://github.com/sipeed/picoclaw/](https://github.com/sipeed/picoclaw/)
- [https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610](https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610)
- [https://github.com/sipeed/picoclaw/issues/3080](https://github.com/sipeed/picoclaw/issues/3080)
- [https://github.com/sipeed/picoclaw/pull/3083](https://github.com/sipeed/picoclaw/pull/3083)
- [https://vuldb.com/cve/CVE-2026-16198](https://vuldb.com/cve/CVE-2026-16198)
- [https://vuldb.com/submit/852965](https://vuldb.com/submit/852965)
- [https://vuldb.com/vuln/380014](https://vuldb.com/vuln/380014)

## Related threats

- [Sipeed PicoClaw missing authorization in Feishu Group Message Handler](https://junglewise.ai/threats/cve-2026-16197-sipeed-picoclaw-missing-authorization-in-feishu-group-message)
- [Sipeed PicoClaw SSRF in web_fetch via special-use IPv4 bypass](https://junglewise.ai/threats/cve-2026-16196-sipeed-picoclaw-ssrf-in-web-fetch-via-special-use-ipv4-bypass)
- [Sipeed PicoClaw incorrect authorization in WeCom Group Message Handler](https://junglewise.ai/threats/cve-2026-16195-sipeed-picoclaw-incorrect-authorization-in-wecom-group-message)
- [Sipeed PicoClaw untrusted functionality inclusion in NewContextBuilder](https://junglewise.ai/threats/cve-2026-16085-sipeed-picoclaw-untrusted-functionality-inclusion-in)
- [Sipeed PicoClaw SSRF bypass in web_fetch via ISATAP literals](https://junglewise.ai/threats/cve-2026-16084-sipeed-picoclaw-ssrf-bypass-in-web-fetch-via-isatap-literals)