CVE-2026-16195— Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16195
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
Source: NVD (National Vulnerability Database)
Vulnerability Description
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-16195
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16195
请登录查看更多情报信息。
Proof of Concept for CVE-2026-16195 (1)
Same Patch Batch · Sipeed · 2026-07-18 · 9 CVEs total
| CVE-2026-16084 | 7.3 HIGH | Sipeed PicoClaw web.go web_fetch server-side request forgery |
| CVE-2026-16196 | 6.3 MEDIUM | Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery |
| CVE-2026-16197 | 6.3 MEDIUM | Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization |
| CVE-2026-16198 | 5.6 MEDIUM | Sipeed PicoClaw First Run Setup access_control.go authentication bypass |
| CVE-2026-16083 | 5.3 MEDIUM | Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay |
| CVE-2026-16082 | 5.3 MEDIUM | Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou |
| CVE-2026-16085 | 5.3 MEDIUM | Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted con |
| CVE-2026-16081 | 4.3 MEDIUM | Sipeed PicoClaw auth.go cross-site request forgery |
IV. Related Vulnerabilities
Same product: PicoClaw
- CVE-2026-16198
Sipeed PicoClaw First Run Setup access_control.go authentica - CVE-2026-16197
Sipeed PicoClaw Group Message feishu_64.go handleMessageRece - CVE-2026-16196
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP ser - CVE-2026-16085
Sipeed PicoClaw context.go NewContextBuilder inclusion of fu - CVE-2026-16084
Sipeed PicoClaw web.go web_fetch server-side request forgery
Same vendor: Sipeed
- CVE-2026-16198
Sipeed PicoClaw First Run Setup access_control.go authentica - CVE-2026-16197
Sipeed PicoClaw Group Message feishu_64.go handleMessageRece - CVE-2026-16196
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP ser - CVE-2026-16085
Sipeed PicoClaw context.go NewContextBuilder inclusion of fu - CVE-2026-16084
Sipeed PicoClaw web.go web_fetch server-side request forgery
Same weakness: CWE-863
- CVE-2026-16200
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization - CVE-2026-10130
QueryWeaver Authentication Bypass via Email Signup Token Iss - CVE-2026-16126
zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request - CVE-2026-16122
nextlevelbuilder GoClaw exec_approval.go matchesAllowlist au - CVE-2025-71390
SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution
V. Comments for CVE-2026-16195
No comments yet