CVE-2026-15318: Sipeed PicoClaw MQTT Channel mqtt.go authorization

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-10 · updated 2026-10-25
Weakness: CWE-285

Description

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Affected products

Sipeed PicoClaw: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5 (+4)

References

https://github.com/sipeed/picoclaw/
https://github.com/sipeed/picoclaw/issues/3068
https://vuldb.com/cve/CVE-2026-15318
https://vuldb.com/submit/852879
https://vuldb.com/vuln/377258
https://vuldb.com/vuln/377258/cti

Get alerted when CVE-2026-15318 or the next vulnerability affects your stack