CVE-2026-15320 | Sipeed PicoClaw up to 0.2.9 pico.go rt.ReloadConfig message.send authorization (Issue 3071)

A vulnerability, which was classified as problematic, has been found in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization.

This vulnerability is cataloged as CVE-2026-15320. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The reported GitHub issue was closed automatically due to inactivity.