CVE-2026-16198: Sipeed PicoClaw Auth Bypass Vulnerability

CVE-2026-16198 Overview

CVE-2026-16198 is an authentication bypass vulnerability in Sipeed PicoClaw versions up to 0.2.9. The flaw resides in the web/backend/middleware/access_control.go file within the First Run Setup component. Attackers can manipulate the allowed_cidrs argument to bypass authentication using an alternate channel [CWE-287]. The vulnerability is remotely exploitable but requires high attack complexity, and a public exploit is available. The maintainers released a patch identified by commit hash 017601354be38cb027ff3ffb01aed79bd5d12610.

Critical Impact
Remote attackers can bypass authentication controls in PicoClaw's web backend by manipulating trusted proxy client IP parsing, gaining unauthorized access to first-run setup functionality.

Affected Products

Sipeed PicoClaw versions up to and including 0.2.9
Component: web/backend/middleware/access_control.go
Feature: First Run Setup

Discovery Timeline

2026-07-19 - CVE-2026-16198 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16198

Vulnerability Analysis

The vulnerability affects the access control middleware in Sipeed PicoClaw's web backend. The middleware handles client IP identification for requests routed through trusted proxies. When a request originates from an IP address within the configured trustedProxyNets, the middleware trusts the X-Forwarded-For header to determine the true client IP. This trust relationship is exploited by manipulating the allowed_cidrs argument used in access control decisions during First Run Setup.

Because the pre-patch code accepted any parseable value from X-Forwarded-For without validating it against the trusted proxy network scope, an attacker able to reach the proxy could supply a spoofed client IP. The bypass enables unauthorized access through an alternate channel, mapped to [CWE-287] Improper Authentication.

Root Cause

The root cause is insufficient validation of the X-Forwarded-For header when resolving the effective client IP behind trusted proxies. The clientIPFromXForwardedFor function did not consider the trusted proxy network set or the peer IP when parsing forwarded addresses. This allowed a forwarded IP value to override the actual peer IP without verifying its position in the proxy chain.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests containing malicious X-Forwarded-For header values while targeting a PicoClaw instance that trusts one or more proxy networks. By supplying a spoofed IP inside the configured allowed_cidrs range, the attacker bypasses the access control check on the First Run Setup endpoint. Attack complexity is rated high, reflecting the specific proxy trust configuration required.

 	ip := peerIP
 	if containsIP(trustedProxyNets, peerIP) {
-		if forwardedIP := clientIPFromXForwardedFor(r.Header.Get("X-Forwarded-For")); forwardedIP != nil {
-			ip = forwardedIP
-		}
+		ip = clientIPFromXForwardedFor(r.Header.Get("X-Forwarded-For"), trustedProxyNets, peerIP)
 	}
 
 	if cfg.AllowLocalhostBypass && ip.IsLoopback() {
// Source: https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610

The patch hardens the client IP parser by passing the trusted proxy network set and peer IP into clientIPFromXForwardedFor, allowing the function to walk the forwarded chain and reject untrusted hops.

Detection Methods for CVE-2026-16198

Indicators of Compromise

Unexpected successful HTTP requests to First Run Setup endpoints from clients presenting X-Forwarded-For headers containing loopback or internal CIDR ranges.
Access log entries showing authenticated actions where the effective client IP differs from the peer IP without a legitimate proxy hop.
Configuration changes made through the setup endpoint on already-provisioned PicoClaw instances.

Detection Strategies

Inspect reverse proxy and application logs for inbound X-Forwarded-For values that resolve inside the configured allowed_cidrs range from untrusted sources.
Correlate peer IP versus resolved client IP fields in access logs to flag mismatches produced by header spoofing.
Alert on any First Run Setup requests occurring after initial deployment, since these should be rare in production.

Monitoring Recommendations

Enable verbose logging in the PicoClaw access control middleware to capture both the peer IP and forwarded IP for every request.
Forward web tier logs to a centralized analytics platform for correlation across proxy and application layers.
Track authentication-related requests to web/backend/middleware/access_control.go protected routes and baseline normal traffic patterns.

How to Mitigate CVE-2026-16198

Immediate Actions Required

Upgrade Sipeed PicoClaw to the version containing commit 017601354be38cb027ff3ffb01aed79bd5d12610 or later.
Restrict network exposure of PicoClaw web backend endpoints to trusted management networks only.
Review and tighten the trustedProxyNets and allowed_cidrs configuration to the minimum required scope.

Patch Information

The fix is available in the upstream PicoClaw repository as commit 017601354be38cb027ff3ffb01aed79bd5d12610, referenced in GitHub Pull Request #3083 and tracked under GitHub Issue #3080. The patch modifies clientIPFromXForwardedFor to require the trusted proxy network set and peer IP as inputs, ensuring only hops originating from trusted proxies are accepted as the effective client IP. See the GitHub Commit Details for the full diff.

Workarounds

Disable trust of the X-Forwarded-For header by removing all entries from the trusted proxy networks configuration until the patch is applied.
Place PicoClaw behind a hardened reverse proxy that overwrites, rather than appends to, the X-Forwarded-For header on ingress.
Block external access to First Run Setup routes via firewall or web server rules until the instance is fully provisioned and patched.

bash

# Example nginx configuration to overwrite X-Forwarded-For at the edge
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://picoclaw_backend;
}