CVE-2026-16083: fallo de gravedad media en Sipeed PicoClaw
Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.7%
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Sipeed · PicoClawPoCs públicas encontradas — 1
cve_referencegithub.com/sipeed/picoclaw/issues/3073no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Sipeed PicoClaw
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-16198MEDIUMSipeed PicoClaw First Run Setup access_control.go authentication bypassEPSS 0.6%CVE-2026-16084MEDIUMSipeed PicoClaw web.go web_fetch server-side request forgeryEPSS 0.6%CVE-2026-15319MEDIUMSipeed PicoClaw Launcher access_control.go IPAllowlist access controlEPSS 0.5%CVE-2026-15317MEDIUMSipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgeryEPSS 0.4%CVE-2026-16196MEDIUMSipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgeryEPSS 0.4%CVE-2026-15320MEDIUMSipeed PicoClaw pico.go rt.ReloadConfig authorizationEPSS 0.4%