CVE-2026-15317: Server-Side Request Forgery in Sipeed PicoClaw 0.2.9

Technical summary

The vulnerability exists in the WebFetchTool.Execute function within pkg/tools/integration/web.go of Sipeed PicoClaw. The component fails to properly validate or restrict the destinations of web fetch requests, allowing an attacker to supply arbitrary URLs. Because the server executes these requests on behalf of the user, an attacker can pivot from the internet-facing application to internal networks or services. The attack vector is network-based with low complexity and no privilege escalation required, though user interaction is necessary to trigger the malicious request.

Business impact

Organizations deploying PicoClaw may face data exfiltration risks if internal services or cloud metadata endpoints are accessible through the vulnerable fetch function. An attacker could discover internal IP ranges, service configurations, or sensitive credentials stored in cloud metadata. Additionally, the compromised server could be used as a pivot point for lateral movement within corporate networks or to launch attacks against third-party systems, creating compliance and liability exposure.

Affected systems

Sipeed PicoClaw versions up to and including 0.2.9 are vulnerable. Organizations should verify their installed versions immediately. The GitHub repository may contain additional context on affected releases and available patches.

Exploitability

This vulnerability is actively exploitable. Public exploit code is available, and the attack requires only network access and user interaction—no authentication or special privileges. The low attack complexity means standard web-based attack vectors (phishing, malicious links in emails or forums) can deliver the exploit effectively. The presence of public code and closed GitHub issue suggests this flaw has received attention from the security research community.

Remediation

Upgrade Sipeed PicoClaw to a patched version beyond 0.2.9. Consult the official Sipeed repository or security advisory for the specific patch version. Until patching is possible, restrict network access to PicoClaw instances using firewall rules or network segmentation, limit outbound requests from the application, and educate users to avoid clicking untrusted links that invoke the web fetch feature.

Patch guidance

Check the Sipeed PicoClaw GitHub repository and official release notes for versions newer than 0.2.9. Apply the patch to all instances in your environment—including development, staging, and production. Verify the patch by reviewing the changes to pkg/tools/integration/web.go and confirming proper URL validation is enforced. Test the patched version in a controlled environment before broad rollout.

Detection guidance

Monitor for unusual outbound requests from PicoClaw processes, particularly to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata services (169.254.169.254). Log and alert on requests to non-whitelisted external hosts. Review web access logs for patterns of fetch requests to unexpected destinations. Watch for user complaints about slow performance, which may indicate SSRF probing activity. Implement network-layer monitoring to detect lateral movement from the PicoClaw server.

Why prioritize this

Although the CVSS score is MEDIUM (6.3), the active public exploit code, low attack complexity, and risk of internal network compromise warrant prompt patching. The user interaction requirement prevents widespread automated attacks, but targeted campaigns remain likely. Prioritize systems exposed to untrusted users or hosting sensitive data accessible via internal services.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects network accessibility, low attack complexity, and the lack of authentication—all increasing risk. However, the required user interaction and limited impact scope (confidentiality, integrity, and availability of some resources) keep it in the MEDIUM range rather than HIGH. In practice, organizational risk may be elevated if internal services are poorly segmented or if the application handles sensitive workflows.

Frequently asked questions