CVE-2026-16081

EUVD-2026-45357
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 4b0229351678f479429b8d8b19207757266f246b. Applying a patch is advised to resolve this issue.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
sipeedpicoclaw
0.2.0
CNA
sipeedpicoclaw
0.2.1
CNA
sipeedpicoclaw
0.2.2
CNA
sipeedpicoclaw
0.2.3
CNA
sipeedpicoclaw
0.2.4
CNA
sipeedpicoclaw
0.2.5
CNA
sipeedpicoclaw
0.2.6
CNA
sipeedpicoclaw
0.2.7
CNA
sipeedpicoclaw
0.2.8
CNA
sipeedpicoclaw
0.2.9
CNA
Common Weakness Enumeration
References
https://github.com/sipeed/picoclaw/
https://github.com/sipeed/picoclaw/commit/4b0229351678f479429b8d8b19207757266f246b
https://github.com/sipeed/picoclaw/issues/3072
https://github.com/sipeed/picoclaw/pull/3160
https://vuldb.com/cve/CVE-2026-16081
https://vuldb.com/submit/852943
https://vuldb.com/vuln/379793
https://vuldb.com/vuln/379793/cti