CVE-2026-15320
MEDIUMSipeed PicoClaw pico.go rt.ReloadConfig authorization
Title source: cnaDescription
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-377260 | Sipeed PicoClaw pico.go rt.ReloadConfig authorization
https://vuldb.com/vuln/377260
Signature, Permissions Required signature
permissions-required
VDB-377260 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/377260/cti
Exploit exploit
issue-tracking
https://github.com/sipeed/picoclaw/issues/3071
Third Party Advisory third-party-advisory
CVE-2026-15320 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15320
Third Party Advisory third-party-advisory
Submit #852942 | Sipeed PicoClaw <= 0.2.9 Missing Authorization (CWE-862)
https://vuldb.com/submit/852942
Product product
https://github.com/sipeed/picoclaw/
Scores
CVSS v3
5.4
EPSS
0.0023
EPSS Percentile
14.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
CWE-863
Status
published
Products (10)
Sipeed/PicoClaw
0.2.0
Sipeed/PicoClaw
0.2.1
Sipeed/PicoClaw
0.2.2
Sipeed/PicoClaw
0.2.3
Sipeed/PicoClaw
0.2.4
Sipeed/PicoClaw
0.2.5
Sipeed/PicoClaw
0.2.6
Sipeed/PicoClaw
0.2.7
Sipeed/PicoClaw
0.2.8
Sipeed/PicoClaw
0.2.9
Published
Jul 10, 2026
Tracked Since
Jul 10, 2026