CVE-2026-15318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15318", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-09T18:07:35.019Z", "datePublished": "2026-07-10T01:30:09.422Z", "dateUpdated": "2026-07-10T20:31:39.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-10T01:30:09.422Z"}, "title": "Sipeed PicoClaw MQTT Channel mqtt.go authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Sipeed", "product": "PicoClaw", "versions": [{"version": "0.2.0", "status": "affected"}, {"version": "0.2.1", "status": "affected"}, {"version": "0.2.2", "status": "affected"}, {"version": "0.2.3", "status": "affected"}, {"version": "0.2.4", "status": "affected"}, {"version": "0.2.5", "status": "affected"}, {"version": "0.2.6", "status": "affected"}, {"version": "0.2.7", "status": "affected"}, {"version": "0.2.8", "status": "affected"}, {"version": "0.2.9", "status": "affected"}], "cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "modules": ["MQTT Channel Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-09T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-09T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-09T20:12:47.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-d (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/377258", "name": "VDB-377258 | Sipeed PicoClaw MQTT Channel mqtt.go authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377258/cti", "name": "VDB-377258 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15318", "name": "CVE-2026-15318 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/852879", "name": "Submit #852879 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sipeed/picoclaw/issues/3068", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/sipeed/picoclaw/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T20:25:51.936838Z", "id": "CVE-2026-15318", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:31:39.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15318", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T20:25:51.936838Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:26:00.711Z"}}], "cna": {"title": "Sipeed PicoClaw MQTT Channel mqtt.go authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-d (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "vendor": "Sipeed", "modules": ["MQTT Channel Handler"], "product": "PicoClaw", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}]}], "timeline": [{"lang": "en", "time": "2026-07-09T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-09T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-09T20:12:47.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377258", "name": "VDB-377258 | Sipeed PicoClaw MQTT Channel mqtt.go authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377258/cti", "name": "VDB-377258 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15318", "name": "CVE-2026-15318 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/852879", "name": "Submit #852879 | Sipeed PicoClaw <= 0.2.9 Incorrect Authorization (CWE-863)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sipeed/picoclaw/issues/3068", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/sipeed/picoclaw/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-10T01:30:09.422Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15318", "state": "PUBLISHED", "dateUpdated": "2026-07-10T20:31:39.059Z", "dateReserved": "2026-07-09T18:07:35.019Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-10T01:30:09.422Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"], "modules": ["MQTT Channel Handler"], "product": "PicoClaw", "vendor": "Sipeed", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity."}, {"lang": "es", "value": "Se ha identificado una debilidad en Sipeed PicoClaw hasta la versi\u00f3n 0.2.9. Afecta a alguna funcionalidad desconocida del archivo pkg/channels/mqtt/mqtt.go del componente Gestor de Canal MQTT. Esta manipulaci\u00f3n del argumento client_id causa una autorizaci\u00f3n incorrecta. El ataque puede llevarse a cabo de forma remota. El exploit se ha hecho p\u00fablico y podr\u00eda usarse para ataques. El problema de GitHub reportado se cerr\u00f3 autom\u00e1ticamente debido a la inactividad."}], "id": "CVE-2026-15318", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15318", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T20:25:51.936838Z", "version": "2.0.3"}}]}, "published": "2026-07-10T02:16:25.457", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/sipeed/picoclaw/"}, {"source": "cna@vuldb.com", "url": "https://github.com/sipeed/picoclaw/issues/3068"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15318"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/852879"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377258"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377258/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-863"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.9"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PicoClaw", "source": "cna", "vendor": "Sipeed"}, "product": "picoclaw", "vendor": "sipeed"}], "created": "2026-07-10T02:30:16.762212+00:00", "updated": "2026-08-01T13:30:04.226964+00:00", "vendors": ["sipeed", "sipeed$PRODUCT$picoclaw"]}