CVE-2026-15317: Sipeed PicoClaw SSRF Vulnerability

CVE-2026-15317 Overview

CVE-2026-15317 is a server-side request forgery (SSRF) vulnerability affecting Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the WebFetchTool.Execute function within pkg/tools/integration/web.go, which is part of the Guarded Web Fetch Flow component. Attackers can manipulate the function to issue arbitrary outbound requests from the vulnerable host. The vulnerability is remotely exploitable and a public exploit has been released. The associated GitHub issue was closed automatically due to inactivity, indicating no vendor-supplied patch is available at the time of disclosure.

Critical Impact
Remote attackers can coerce the PicoClaw server into making arbitrary HTTP requests, enabling internal reconnaissance, access to metadata services, and interaction with otherwise unreachable internal systems.

Affected Products

Sipeed PicoClaw versions up to and including 0.2.9
Component: Guarded Web Fetch Flow
File: pkg/tools/integration/web.go (function WebFetchTool.Execute)

Discovery Timeline

2026-07-10 - CVE-2026-15317 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15317

Vulnerability Analysis

The vulnerability is a server-side request forgery classified under [CWE-918]. The WebFetchTool.Execute function in pkg/tools/integration/web.go accepts a URL parameter that is passed to an outbound HTTP client without adequate validation of the destination. The "Guarded" prefix on the flow suggests protective checks were intended, but the implementation does not sufficiently restrict the target URL. Attackers can supply URLs pointing to internal IP ranges, loopback interfaces, or cloud metadata endpoints. The server then executes those requests using its own network identity and returns response data to the caller.

Root Cause

The root cause is missing or bypassable validation of user-supplied URLs before they reach the outbound HTTP fetch logic. Filters intended to block private address ranges, link-local addresses, and cloud metadata endpoints (such as 169.254.169.254) either fail to normalize input or omit key protections such as DNS rebinding checks and redirect validation.

Attack Vector

The attack requires network access to the PicoClaw web endpoint and passive user interaction according to the CVSS 4.0 vector. An attacker submits a crafted URL to the WebFetchTool interface. The server issues an HTTP request to that URL, allowing the attacker to probe internal services, exfiltrate response bodies, or interact with cloud metadata APIs. Because the public proof of concept is available, exploitation does not require novel research effort.

No verified exploit code is republished here. Refer to the GitHub PoC Repository and the VulDB Vulnerability Details for technical specifics.

Detection Methods for CVE-2026-15317

Indicators of Compromise

Outbound HTTP requests from the PicoClaw process to internal RFC1918 ranges, loopback addresses, or 169.254.169.254.
Unusual URL parameters in requests to the WebFetchTool endpoint containing internal hostnames, IP literals, or non-standard ports.
Log entries showing WebFetchTool fetching URLs that resolve to non-public destinations.

Detection Strategies

Inspect application logs for WebFetchTool.Execute invocations and correlate target URLs against an allowlist of expected external domains.
Deploy egress network monitoring that flags PicoClaw-originated traffic to private CIDR ranges and cloud metadata endpoints.
Alert on repeated fetch attempts from a single user session to varied internal addresses, which suggests SSRF probing.

Monitoring Recommendations

Enable verbose request logging on the PicoClaw service and forward logs to a centralized analytics platform for correlation.
Monitor for anomalous DNS resolutions initiated by the PicoClaw host, especially to short-TTL domains that could indicate DNS rebinding.
Track HTTP response sizes returned by the fetch endpoint; large or unusual payloads may indicate exfiltration of internal service data.

How to Mitigate CVE-2026-15317

Immediate Actions Required

Restrict network egress from hosts running PicoClaw so the service cannot reach internal management networks or cloud metadata endpoints.
Place the WebFetchTool endpoint behind authentication and limit access to trusted users only.
Disable or remove the WebFetchTool integration if it is not required for operational use.

Patch Information

No official vendor patch is available. The associated GitHub Issue was closed automatically due to inactivity. Monitor the Sipeed PicoClaw repository for future releases beyond version 0.2.9 that address the SSRF flaw.

Workarounds

Deploy an outbound proxy that enforces a strict allowlist of destination hostnames for all PicoClaw web fetches.
Block resolution and routing to private address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) from the PicoClaw host.
Implement a reverse proxy or WAF rule that inspects and rejects fetch requests containing IP literals, non-HTTP schemes, or internal hostnames.

bash

# Example iptables rule to block egress from PicoClaw host to cloud metadata service
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 192.168.0.0/16 -j REJECT