Server-Side Request Forgery in Picobot Web Tool

Executive Summary

CVE-2026-15668 is a server-side request forgery (SSRF) vulnerability in louisho5 picobot up to version 0.2.0. The issue occurs in the WebTool.Execute function located in internal/agent/tools/web.go.

The vulnerability allows an attacker to manipulate the 'url' argument passed to the web tool, enabling the agent to make unauthorized HTTP GET requests to localhost or internal network addresses. This happens because the function does not validate hostnames, block loopback or RFC1918 addresses, or check redirects before sending requests.

An attacker with access to the Picobot agent can exploit this to fetch internal resources, such as dashboards or debug endpoints, and expose their contents in the model's transcript. The web tool is enabled by default in standard deployments, making the vulnerability accessible without additional configuration.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-15668 vulnerability on your network or system, you can check if the affected Picobot version (0.2.0 or earlier) is running and verify if the web tool is enabled without proper SSRF protections.

• Check the installed version of Picobot by running the binary with the --version flag or inspecting the configuration file. Example command: ./picobot --version
• Inspect the Picobot logs for unusual HTTP requests originating from the agent, particularly those targeting localhost or internal IP addresses (e.g., 127.0.0.1, 192.168.x.x, 10.x.x.x).
• Use network monitoring tools like tcpdump or Wireshark to capture outbound HTTP requests from the Picobot process. Example command: sudo tcpdump -i any -A 'port 80 or port 443 and host <picobot-ip>'
• Test for SSRF by attempting to induce the Picobot agent to make a request to an internal or loopback address. For example, send a command to Picobot to fetch a URL like http://127.0.0.1:8080 or http://localhost/admin. If the agent returns the content of the internal resource, the vulnerability is present.
• Review the Picobot configuration file (typically config.json) to see if the web tool is enabled. Look for entries related to tools or the web tool specifically.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using or interacting with an affected version of Picobot (version 0.2.0 or earlier):

• Exposure of sensitive internal data: An attacker could access internal HTTP services, such as dashboards, debug endpoints, or configuration files, and retrieve their contents. This may include sensitive information like credentials, tokens, or internal documentation.
• Unauthorized access to localhost services: If Picobot is running on a machine with other services bound to localhost, an attacker could interact with those services, potentially leading to further exploitation or data leaks.
• Network reconnaissance: The vulnerability allows attackers to probe internal networks, identifying other vulnerable services or systems that are not exposed to the public internet.
• Potential for further attacks: If internal services are misconfigured or vulnerable, the SSRF could serve as a stepping stone for additional attacks, such as remote code execution or privilege escalation.

Exploitation requires an attacker to have access to the Picobot agent, either as a legitimate user or by tricking an operator into inducing a web tool call targeting internal endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with common standards and regulations, depending on the context in which Picobot is used:

• GDPR (General Data Protection Regulation): If Picobot is used to process or interact with personal data of EU citizens, the SSRF vulnerability could lead to unauthorized access to sensitive information. This may result in a data breach, triggering GDPR's reporting requirements and potential fines for failing to implement adequate technical safeguards (Article 32).
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could expose internal systems containing PHI. Unauthorized access to such data would constitute a breach under HIPAA, requiring notification and potentially leading to penalties for non-compliance with the Security Rule.
• PCI DSS (Payment Card Industry Data Security Standard): If Picobot is part of or interacts with systems processing payment card data, the SSRF vulnerability could enable attackers to access cardholder data environments. This would violate PCI DSS requirements for securing internal systems and could result in fines or loss of payment processing capabilities.
• Other industry-specific regulations: Depending on the sector (e.g., finance, government), this vulnerability could violate additional standards like SOX (Sarbanes-Oxley Act) or FISMA (Federal Information Security Management Act), which mandate controls for protecting sensitive data and systems.

The lack of proper input validation and access controls in Picobot directly conflicts with the security principles outlined in these regulations, which emphasize the need for robust safeguards to prevent unauthorized access to sensitive systems and data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-15668, follow these immediate steps to reduce the risk of exploitation:

• Disable the web tool in Picobot if it is not required for your use case. This can be done by removing or commenting out the web tool registration in the agent loop configuration or code.
• Upgrade Picobot to a patched version as soon as one becomes available. Monitor the project's GitHub repository or official channels for updates.
• Restrict network access for the Picobot agent to prevent it from making outbound requests to internal or loopback addresses. Use firewall rules to block requests to RFC1918 addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.1).
• Implement network segmentation to isolate the Picobot agent from internal resources. Ensure it runs in a restricted environment with minimal access to sensitive systems.
• Monitor and log all outbound HTTP requests made by the Picobot agent. Set up alerts for requests targeting internal or unusual destinations.
• If possible, modify the Picobot source code to add SSRF protections. This includes validating URLs, blocking requests to localhost or private IP ranges, and disabling HTTP redirects. Example: Add checks in the WebTool.Execute function to reject URLs with internal hostnames.
• Limit access to the Picobot agent to trusted users only. Ensure that only authorized personnel can interact with the agent to reduce the risk of exploitation.

Useful 0 Not Useful 0