CVE-2026-16197: Sipeed PicoClaw Auth Bypass Vulnerability

CVE-2026-16197 Overview

CVE-2026-16197 is a missing authorization vulnerability [CWE-862] affecting Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the handleMessageReceive function within pkg/channels/feishu/feishu_64.go, part of the Group Message Handler component. Attackers can trigger the weakness remotely without local access. Public disclosure of the exploit technique has occurred, though no confirmed in-the-wild exploitation has been reported. The associated GitHub issue was closed automatically due to inactivity, leaving the upstream remediation status ambiguous.

Critical Impact
Remote attackers with low privileges can bypass authorization checks in the Feishu group message handler, resulting in limited confidentiality, integrity, and availability impact on affected PicoClaw deployments.

Affected Products

Sipeed PicoClaw versions up to and including 0.2.9
Component: Group Message Handler (pkg/channels/feishu/feishu_64.go)
Function: handleMessageReceive

Discovery Timeline

2026-07-18 - CVE-2026-16197 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16197

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement inside the handleMessageReceive function in pkg/channels/feishu/feishu_64.go. This handler processes inbound Feishu group messages but fails to verify whether the requesting principal is authorized to invoke the associated actions. As a result, low-privileged remote actors can trigger message-handling logic they should not be able to reach. The scope of impact is limited: confidentiality, integrity, and availability are each partially affected, consistent with a low-severity classification. The vulnerability requires network reachability to the PicoClaw service and low-level privileges, but no user interaction is needed.

Root Cause

The root cause is an authorization gap [CWE-862] in the Feishu channel handler. The function processes group message events without validating the caller's identity or permissions against the intended action. This design omission allows requests that should be rejected to reach message-processing logic.

Attack Vector

An attacker with network access and low-level credentials sends crafted messages or events to the Feishu group message handler. Because handleMessageReceive does not enforce authorization, the handler processes the input as if it were legitimate. No user interaction or elevated privileges are required. Refer to the GitHub PoC Repository and the VulDB Vulnerability Details for additional technical context. No verified proof-of-concept code has been published in this dataset.

Detection Methods for CVE-2026-16197

Indicators of Compromise

Unexpected invocations of the handleMessageReceive function originating from unauthenticated or low-privileged sources.
Feishu group message events processed by PicoClaw that do not correlate with legitimate user or workspace activity.
Anomalous outbound actions triggered by the PicoClaw Feishu channel that do not match approved workflows.

Detection Strategies

Instrument the PicoClaw Feishu channel with request logging that captures caller identity, message payload metadata, and handler outcome.
Compare inbound Feishu event sources against an allowlist of expected group IDs and tenant identifiers.
Alert on repeated handler invocations from a single source that lack a corresponding authorized session.

Monitoring Recommendations

Forward PicoClaw application logs to a centralized SIEM for correlation with network and identity telemetry.
Track baselines for Feishu message processing volume and flag deviations that could indicate abuse of the missing authorization flaw.
Monitor the upstream GitHub Issue Tracker for remediation updates.

How to Mitigate CVE-2026-16197

Immediate Actions Required

Inventory all Sipeed PicoClaw deployments and identify instances running version 0.2.9 or earlier with the Feishu channel enabled.
Restrict network exposure of the PicoClaw Feishu webhook endpoint to trusted sources only.
Disable the Feishu channel integration where it is not required for business operations.

Patch Information

No vendor-issued patch is referenced in the available data. The upstream issue at the GitHub Issue Tracker was closed automatically due to inactivity. Consult the VulDB CVE Entry for the latest remediation status before deploying updates.

Workarounds

Place PicoClaw behind an authenticating reverse proxy that validates caller identity before requests reach handleMessageReceive.
Enforce IP allowlisting so that only Feishu's documented callback ranges can reach the Group Message Handler.
Add application-layer authorization checks to the Feishu channel handler through a local fork or patch until upstream remediation is available.

bash

# Configuration example: restrict inbound access to the PicoClaw Feishu endpoint
# Example iptables rule allowing only trusted CIDR ranges to reach the service
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP