Low
Sipeed PicoClaw pico.go rt.ReloadConfig authorization
Type: advisorySources: OSV
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-15320
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 19:15 UTC · Revision 1
Source evidence
Sipeed PicoClaw pico.go rt.ReloadConfig authorization
core-osv · Original sourcePublished 10 Jul 2026, 02:00 UTC
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.
osv:CVE-2026-15320
Complete source record
{
"id": "00ab0f0a87a9e6c222a48c47553b2286e7c1c85658fb279bbec8e857d61eebe1",
"url": "https://osv.dev/vulnerability/CVE-2026-15320",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Sipeed PicoClaw pico.go rt.ReloadConfig authorization",
"summary": "A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.",
"evidence": "osv:CVE-2026-15320",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-15320",
"aliases": [
"CVE-2026-15320"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sipeed/picoclaw",
"type": "GIT",
"events": [
{
"introduced": "8207c1c7e6006c0664dfec99fd6bbbda34d2550a"
},
{
"last_affected": "2992eccbf03e54258a6889cf19a5a4fe6255895f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.2.0"
},
{
"last_affected": "0.2.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.1"
},
{
"last_affected": "0.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.2"
},
{
"last_affected": "0.2.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.3"
},
{
"last_affected": "0.2.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.4"
},
{
"last_affected": "0.2.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.5"
},
{
"last_affected": "0.2.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.6"
},
{
"last_affected": "0.2.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.7"
},
{
"last_affected": "0.2.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.8"
},
{
"last_affected": "0.2.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2.9"
},
{
"last_affected": "0.2.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.2.9"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"v0.2.9",
"v0.2.8",
"v0.2.7",
"v0.2.6",
"v0.2.5",
"v0.2.4",
"v0.2.3",
"v0.2.2",
"v0.2.2-nightly.20260312.6612ca09",
"v0.2.1",
"v0.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15320.json"
}
}
],
"modified": "2026-10-28T02:30:31.491079547Z",
"provider": "osv",
"references": [
"https://github.com/sipeed/picoclaw/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15320.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-15320",
"https://vuldb.com/cve/CVE-2026-15320",
"https://vuldb.com/submit/852942",
"https://vuldb.com/vuln/377260",
"https://github.com/sipeed/picoclaw/issues/3071",
"https://vuldb.com/vuln/377260/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15320.json"
}
},
"related_cves": [
{
"value": "CVE-2026-15320",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 498658,
"published_at": "2026-07-10T02:00:08.478+00:00"
}