CVE-2026-16082 Overview
CVE-2026-16082 is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-362] affecting Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the ExecTool.executeRun function within pkg/agent/pipeline_execute.go. Manipulating the cwe argument creates a window between validation and use that a local attacker can exploit. The vulnerability requires local access and low privileges to trigger. A public exploit reference exists, and the associated GitHub issue was closed automatically by a bot with the label "not planned," indicating no upstream fix is planned at this time.
Critical Impact
Local attackers with low privileges can exploit a race condition in pkg/agent/pipeline_execute.go to compromise the integrity, confidentiality, and availability of PicoClaw operations.
Affected Products
- Sipeed PicoClaw versions through 0.2.9
- Component: pkg/agent/pipeline_execute.go
- Function: ExecTool.executeRun
Discovery Timeline
- 2026-07-18 - CVE-2026-16082 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16082
Vulnerability Analysis
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Sipeed PicoClaw agent pipeline. The ExecTool.executeRun function validates the cwe argument before using it, but the state can change between the validation step and the actual use. An attacker with local access and low privileges can race the executor to substitute a value or resource after checks pass but before the agent consumes the input.
Because PicoClaw is written in Go and orchestrates pipeline execution, a successful race can cause the agent to act on attacker-controlled input that was not the value originally validated. The impact spans confidentiality, integrity, and availability, though each dimension is limited in scope per the reported vector.
Root Cause
The root cause is non-atomic handling of the cwe parameter in ExecTool.executeRun. The check and the subsequent use are separated in code, creating a race window. This pattern is classified under [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization.
Attack Vector
Exploitation requires local access to the host running PicoClaw and a low-privilege account. The attacker triggers pipeline execution and concurrently modifies the resource referenced by the cwe argument during the race window. No user interaction is required. Refer to the GitHub Issue Discussion and the VulDB CVE Entry for reproduction details.
No verified proof-of-concept code is included here. The vulnerability mechanism is described in prose per the available references.
Detection Methods for CVE-2026-16082
Indicators of Compromise
- Rapid, repeated invocations of the PicoClaw agent pipeline by a local user account within short intervals.
- Modification of files or paths referenced by the cwe argument immediately before or during ExecTool.executeRun invocation.
- Unexpected process execution spawned from the PicoClaw agent that does not match the originally submitted pipeline definition.
Detection Strategies
- Enable process auditing on hosts running PicoClaw and correlate ExecTool.executeRun execution events with concurrent file writes by non-privileged users.
- Monitor Go runtime logs and agent stdout/stderr for anomalies in pipeline argument resolution or repeated failed validation attempts.
- Apply file integrity monitoring on directories referenced by pipeline cwe inputs to catch mid-execution tampering.
Monitoring Recommendations
- Collect and centralize PicoClaw agent logs to a SIEM for retrospective analysis and correlation with host telemetry.
- Alert on any local, low-privileged user invoking the PicoClaw agent outside of expected automation windows.
- Track filesystem race patterns such as sub-second create-rename-replace sequences targeting agent-referenced paths.
How to Mitigate CVE-2026-16082
Immediate Actions Required
- Restrict local access to hosts running Sipeed PicoClaw to trusted operators only, since exploitation requires a local low-privilege account.
- Remove or disable PicoClaw agents on systems where the pipeline functionality is not required.
- Audit all local user accounts on affected hosts and remove unnecessary shell or execution privileges.
Patch Information
No vendor patch is available. The upstream GitHub issue was closed automatically by a bot with the label "not planned." Review the GitHub PoC Repository and the VulDB Vulnerability Entry for updates. Organizations should assume the vulnerability will remain unfixed and apply compensating controls.
Workarounds
- Run the PicoClaw agent under a dedicated, isolated service account with no shared filesystem access to other local users.
- Place pipeline input paths on filesystems with strict permissions (mode 0700) owned by the agent account to prevent tampering during the race window.
- Wrap agent invocations with mandatory access control (SELinux/AppArmor) profiles that deny write access to cwe-referenced paths from any account other than the agent's own.
- Consider replacing PicoClaw with an alternative pipeline execution tool if the vendor does not resume maintenance.
# Configuration example: restrict access to PicoClaw agent working directories
sudo chown -R picoclaw:picoclaw /var/lib/picoclaw
sudo chmod -R 700 /var/lib/picoclaw
sudo setfacl -m u:root:rx /var/lib/picoclaw
# AppArmor profile snippet to deny non-agent writes to pipeline inputs
# /etc/apparmor.d/local/picoclaw
deny /var/lib/picoclaw/pipelines/** w,
owner /var/lib/picoclaw/pipelines/** rw,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
