CVE-2026-16196: Sipeed PicoClaw SSRF Vulnerability

CVE-2026-16196 Overview

CVE-2026-16196 is a Server-Side Request Forgery (SSRF) vulnerability affecting Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the isPrivateOrRestrictedIP function within pkg/tools/integration/web.go, which is part of the web_fetch component. The function fails to block requests to certain restricted IP ranges, allowing an authenticated remote attacker to coerce the server into initiating requests to internal or otherwise restricted network destinations. The issue is tracked under CWE-918: Server-Side Request Forgery. A public exploit has been referenced in the disclosure, and upstream maintainers have addressed the issue with commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405.

Critical Impact
Attackers with low-level privileges can leverage the web_fetch component to probe internal network resources, including cloud metadata endpoints previously covered and benchmark ranges that were not filtered.

Affected Products

Sipeed PicoClaw versions up to and including 0.2.9
The web_fetch component in pkg/tools/integration/web.go
Deployments exposing the PicoClaw HTTP integration to untrusted users

Discovery Timeline

2026-07-18 - CVE-2026-16196 published to NVD
2026-07-22 - Last updated in NVD database
Patch commit - 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 merged via Pull Request #3085

Technical Details for CVE-2026-16196

Vulnerability Analysis

The web_fetch component in Sipeed PicoClaw provides an HTTP fetching capability that resolves and requests URLs supplied by callers. To prevent SSRF, the code relies on isPrivateOrRestrictedIP to reject requests targeting private or restricted IPs. The pre-patch implementation enumerated RFC 1918 space, loopback, link-local (including cloud metadata 169.254.0.0/16), carrier-grade NAT, IPv6 unique-local, 6to4, and Teredo ranges. It omitted the IETF benchmark range 198.18.0.0/15, allowing that block to bypass the filter. An attacker submitting a URL that resolves into this range can force the server to issue outbound HTTP requests, potentially reaching internal services bound to those addresses.

Root Cause

The root cause is incomplete deny-list logic in isPrivateOrRestrictedIP. The function enumerated known reserved ranges but omitted 198.18.0.0/15, which is defined by RFC 2544 for benchmarking and is frequently used internally in lab, appliance, and virtualization environments. Because the SSRF protection is expressed as an explicit list rather than a positive allow-list, any missing range creates an exploitable gap.

Attack Vector

An authenticated attacker submits a URL to the web_fetch endpoint that resolves to an address inside 198.18.0.0/15. The isPrivateOrRestrictedIP check returns false, and the server issues an outbound HTTP request to the attacker-chosen target. The attacker can read response content returned by web_fetch to enumerate reachable internal services, retrieve limited data, or interact with unauthenticated internal endpoints hosted within the benchmark range.

// isPrivateOrRestrictedIP returns true for IPs that should never be reached via web_fetch:
// RFC 1918, loopback, link-local (incl. cloud metadata 169.254.x.x), carrier-grade NAT,
// benchmark (198.18.0.0/15), IPv6 unique-local (fc00::/7), 6to4 (2002::/16), and
// Teredo (2001:0000::/32).
func isPrivateOrRestrictedIP(ip net.IP) bool {
	if ip == nil {
		return true
	}
	// ... additional range checks including the newly added 198.18.0.0/15
}

Source: GitHub commit 2efbe5d — the patch extends the deny-list to cover the RFC 2544 benchmark range.

Detection Methods for CVE-2026-16196

Indicators of Compromise

Outbound HTTP requests originating from the PicoClaw process to addresses inside 198.18.0.0/15.
web_fetch invocations containing URLs whose hostnames resolve to internal, benchmark, or otherwise non-public ranges.
Application logs showing successful fetches followed by unexpected internal service responses returned to end users.

Detection Strategies

Inspect PicoClaw request logs for web_fetch targets that resolve to reserved IP ranges, particularly 198.18.0.0/15, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Correlate outbound connections from the PicoClaw host with the destination IP ranges expected for legitimate use, and alert on deviations.
Compare the deployed binary or source tree against the fixed commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 to confirm the patched isPrivateOrRestrictedIP implementation is present.

Monitoring Recommendations

Enable egress network flow logging from hosts running PicoClaw and route logs to a centralized analytics platform.
Alert on repeated web_fetch failures or 4xx/5xx responses that follow patterns of internal address scanning.
Track authenticated user sessions that issue an unusually high number of web_fetch requests within a short window.

How to Mitigate CVE-2026-16196

Immediate Actions Required

Upgrade Sipeed PicoClaw to a version that includes commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405 or later.
Restrict access to the web_fetch functionality to trusted, authenticated users only.
Place PicoClaw instances behind an egress proxy that enforces an allow-list of permitted outbound destinations.

Patch Information

The fix is available in the upstream repository via commit 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405, merged through Pull Request #3085. The patch extends isPrivateOrRestrictedIP to reject IPs in the 198.18.0.0/15 benchmark range. Additional context is available in Issue #3077 and the VulDB CVE Report.

Workarounds

Deploy a network-level egress filter that blocks traffic from the PicoClaw host to 198.18.0.0/15 and all other reserved ranges.
Front PicoClaw with a reverse proxy or service mesh policy that validates outbound destinations against an allow-list of public domains.
Disable the web_fetch integration entirely if it is not required by the deployment.

bash

# Example iptables egress rule blocking the benchmark range from the PicoClaw host
iptables -A OUTPUT -d 198.18.0.0/15 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT