CVE-2026-6987: 
NixOS vulnerability analysis and mitigation

CVE-2026-6987 is a command injection vulnerability in PicoClaw's Web Launcher Management Plane component, specifically in the /api/gateway/restart endpoint. It affects PicoClaw versions up to and including 0.2.4 (Go module github.com/sipeed/picoclaw). The vulnerability was reported via a GitHub issue on April 3, 2026, and publicly disclosed on April 25, 2026; the project had not responded to the report at the time of disclosure. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.5 (Medium/Moderate) (Github Advisory, GitHub Issue).

The root cause is improper neutralization of special elements used in a command (CWE-77) and injection (CWE-74) within PicoClaw's Web Launcher Management Plane. The management plane API lacks authentication, allowing any remote attacker to write arbitrary values into hooks.processes[*].command fields in config.json via the unauthenticated API, then trigger a gateway restart via POST /api/gateway/restart. When the gateway restarts, the injected command is immediately executed as a process hook, resulting in stable remote code execution. Exploitation requires either the target to be launched with picoclaw-launcher -public, the launcher to be deployed as an accessible management plane in the same CIDR segment, allowed_cidrs to be empty, or the attacker's IP to fall within the allowed range (GitHub Issue, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the host running PicoClaw with the privileges of the application process. This results in full compromise of confidentiality, integrity, and availability of the affected system, enabling data exfiltration, persistent backdoor installation, lateral movement within the network, or complete service disruption (Github Advisory, GitHub Issue).

A proof-of-concept exploit with detailed steps is publicly available in the GitHub issue report, demonstrating the full attack chain from config manipulation to RCE (GitHub Issue). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.20–0.22%, placing it around the 45th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible PicoClaw instances (version ≤ 0.2.4) using network scanning tools (e.g., Shodan, Censys, nmap), targeting hosts with the Web Launcher Management Plane exposed — particularly those launched with picoclaw-launcher -public or with an empty allowed_cidrs configuration.
2. Verify unauthenticated access: Confirm that the management plane API is accessible without authentication by sending a test HTTP request to the target host's management API endpoint.
3. Inject malicious command into config: Send an unauthenticated HTTP request to the management plane API to modify config.json, writing a malicious OS command (e.g., a reverse shell) into the hooks.processes[*].command field.
4. Trigger gateway restart: Send an unauthenticated POST request to /api/gateway/restart on the target host to initiate a gateway restart.
5. Achieve RCE: Upon restart, PicoClaw executes the injected command as a process hook with the privileges of the application process, establishing persistent remote code execution (GitHub Issue).

• Network: Unexpected or unauthorized HTTP POST requests to /api/gateway/restart from external or untrusted IP addresses; unauthenticated API calls to the PicoClaw management plane from IPs outside expected CIDR ranges; outbound connections from the PicoClaw host to unknown external IPs (potential reverse shell activity).
• File System: Unexpected modifications to config.json, particularly changes to hooks.processes[*].command fields containing shell commands, encoded payloads, or references to remote hosts; new files (scripts, binaries) created in the PicoClaw working directory.
• Logs: PicoClaw application logs showing repeated or anomalous POST requests to /api/gateway/restart; gateway restart events not initiated by authorized administrators; process hook execution logs referencing unexpected commands.
• Process: Unusual child processes spawned by the PicoClaw process (e.g., bash, sh, curl, wget, nc, python) following a gateway restart event (GitHub Issue).

No patched version of PicoClaw has been released as of the time of disclosure; the GitHub Advisory lists "None" for patched versions and notes the project had not responded to the report (Github Advisory). As immediate workarounds: restrict network access to the PicoClaw management plane using firewall rules or access controls, ensuring the API is not exposed to untrusted networks or the public internet; avoid launching PicoClaw with the -public flag; configure allowed_cidrs to limit access to trusted IP ranges only. Monitor application logs for unauthorized access to /api/gateway/restart and unexpected modifications to config.json. Users should follow the project repository for any future patch releases (GitHub Issue).

The vulnerability was reported by researcher CH13hh via a GitHub issue on April 3, 2026, with a suggested fix of adding mandatory identity authentication to the management interface and implementing strict input validation for hook commands (GitHub Issue). The project maintainers had not responded to the report at the time of public disclosure. The issue was picked up by several vulnerability aggregators and security news feeds shortly after NVD publication on April 25, 2026, but no significant broader media coverage or notable researcher commentary beyond the original report has been identified.