CVE-2026-16084 Overview
CVE-2026-16084 is a Server-Side Request Forgery (SSRF) vulnerability in Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the web_fetch function within pkg/tools/integration/web.go. Attackers can trigger the function to issue arbitrary HTTP requests from the server, including to internal network resources that would otherwise be inaccessible. Remote exploitation is possible without authentication, and a public exploit is available. The vulnerability is tracked as [CWE-918] Server-Side Request Forgery.
Critical Impact
Unauthenticated remote attackers can coerce PicoClaw to fetch internal resources, potentially exposing metadata services, internal APIs, and restricted network segments.
Affected Products
- Sipeed PicoClaw versions up to and including 0.2.9
- Vulnerable component: pkg/tools/integration/web.go (web_fetch function)
- Fixed in commit c15aac21fe05ee103a470e1104bc891754e83392
Discovery Timeline
- 2026-07-18 - CVE-2026-16084 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16084
Vulnerability Analysis
The web_fetch function in pkg/tools/integration/web.go accepts URLs from client input and issues HTTP requests without adequate validation of the destination address. While the codebase includes an IsPrivateOrRestrictedIP helper to block private ranges, the guard fails to account for Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) interface identifiers. ISATAP addresses embed an IPv4 address in the lower 32 bits of an IPv6 address using the pattern 00:00:5e:fe or 02:00:5e:fe. An attacker who crafts an IPv6 URL following this pattern can encode a private IPv4 destination (for example, 169.254.169.254 or 127.0.0.1) that bypasses the private-address filter.
Root Cause
The root cause is incomplete SSRF filter logic. The pre-patch validator inspected 6to4 tunneling addresses but omitted checks for ISATAP-formatted IPv6 addresses. This allowed an embedded internal IPv4 to reach the outbound HTTP client after passing validation.
Attack Vector
A remote, unauthenticated attacker submits a request to the exposed web_fetch endpoint with an ISATAP-encoded IPv6 URL pointing at an internal resource. PicoClaw resolves and fetches the URL server-side, returning content from internal services, cloud instance metadata endpoints, or otherwise restricted infrastructure.
// Security patch adding ISATAP handling to IsPrivateOrRestrictedIP
// Source: https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392
client := net.IPv4(ip[12]^0xff, ip[13]^0xff, ip[14]^0xff, ip[15]^0xff)
return IsPrivateOrRestrictedIP(client)
}
+ // ISATAP interface identifiers embed an IPv4 address behind either
+ // 00:00:5e:fe or 02:00:5e:fe.
+ if ((ip[8] == 0x00 && ip[9] == 0x00) || (ip[8] == 0x02 && ip[9] == 0x00)) &&
+ ip[10] == 0x5e && ip[11] == 0xfe {
+ embedded := net.IPv4(ip[12], ip[13], ip[14], ip[15])
+ return IsPrivateOrRestrictedIP(embedded)
+ }
}
return false
The patch introduces detection for ISATAP-formatted addresses and recursively validates the embedded IPv4 against IsPrivateOrRestrictedIP.
Detection Methods for CVE-2026-16084
Indicators of Compromise
- Outbound HTTP requests from PicoClaw hosts to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, or link-local 169.254.0.0/16
- Requests targeting cloud metadata endpoints (for example, http://169.254.169.254/) originating from PicoClaw processes
- Inbound HTTP requests containing IPv6 URLs matching the ISATAP pattern *::0:5efe:* or *::200:5efe:*
- Unusual DNS resolutions for hostnames that map to ISATAP IPv6 addresses
Detection Strategies
- Inspect application logs of web_fetch calls for user-supplied URLs referencing IPv6 addresses with 5efe in the lower 32 bits
- Correlate PicoClaw process network egress with destination classification to flag traffic to RFC1918, loopback, and link-local ranges
- Deploy web application firewall rules that parse and normalize IPv6 URL parameters before allow-listing destinations
Monitoring Recommendations
- Enable verbose HTTP client logging in PicoClaw and forward to a centralized analytics platform
- Alert on any egress from PicoClaw workloads to cloud instance metadata service IPs
- Track deployed PicoClaw versions across the fleet and flag hosts running 0.2.9 or earlier
How to Mitigate CVE-2026-16084
Immediate Actions Required
- Upgrade PicoClaw to a release that includes patch commit c15aac21fe05ee103a470e1104bc891754e83392 from pull request #3143
- Restrict network egress from PicoClaw hosts using firewall or security-group rules that deny traffic to internal ranges and metadata endpoints
- Audit historical logs for suspicious web_fetch invocations referencing ISATAP-formatted or otherwise obfuscated IPv6 URLs
Patch Information
The upstream fix is available in the Sipeed PicoClaw repository. See the GitHub commit details, the pull request, and the issue discussion. Additional analysis is published in the VulDB CVE details.
Workarounds
- Place PicoClaw behind an egress proxy that enforces allow-listed outbound destinations
- Disable or gate access to the web_fetch integration until the patch is applied
- Configure the host to prefer IPv4-only name resolution to reduce the ISATAP attack surface where IPv6 is not required
# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner picoclaw -d 192.168.0.0/16 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner picoclaw -d fe80::/10 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
