CVE-2026-6987 is a command injection in the PicoClaw Web Launcher management plane, reachable at /api/gateway/restart, in versions up to 0.2.4. NVD scores it 7.3. I found no fixed version, so keep the launcher off shared networks and watch the project's issue tracker.
What's affected
- Product: PicoClaw (sipeed/picoclaw), the Web Launcher management plane.
- Affected versions: up to 0.2.4.
- Fixed version: none found. The record says the project was told early through an issue report and had not responded. The GitHub issue was closed by a bot after inactivity, not by a fix I could see.
- Weaknesses: CWE-74 injection and CWE-77 command injection.
- Severity: CVSS 3.1 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Condition from the issue: the launcher runs in a public mode, or is reachable from the same network range, and the allowed address list is empty or includes the attacker.
How to check if you're exposed
Find out whether you run the launcher and how it is started:
ps aux | grep -i picoclaw
picoclaw --version
Then look at how it is bound. According to the issue, risk arises when the launcher is started in public mode or exposed to a network range where others can reach it, with an empty allowed address list. Check the listening address and any firewall rules. A launcher bound only to localhost is much less exposed.
What to do now
- Find every PicoClaw install and note the version.
- Make sure the Web Launcher listens only on localhost, or on a trusted management network.
- Set the allowed address list so only specific addresses can connect.
- Put authentication in front of the launcher, since the issue says it has none.
- Watch the project's repository for a fix and update when one is released.
- Review the PicoClaw configuration for hook commands you did not add.
Why it matters
According to the issue, the launcher's management plane has no authentication. A caller can change the configuration file, add a command to the list of process hooks, and then restart the gateway. On start, the gateway runs that command. Each step is ordinary, and together they give command execution.
The reporter's suggested fix is mandatory authentication on the management interface and strict validation of hook commands. Open source tools sometimes go quiet after a report, and this is one of those cases. When there is no patch, network controls are your only defense, so use them. The CISA KEV flag is false and no exploitation is reported.
Quick check
Is there a patch?
I did not find one. The record says the project had not responded, and the GitHub issue was closed by an inactivity bot.
What is the safest setup until then?
Bind the launcher to localhost or a trusted network, restrict allowed addresses, and add authentication in front of it.
Sources
Last reviewed: 19 October 2026.
