CVE-2026-6987: PicoClaw Web Launcher Command Injection
The National Vulnerability Database has disclosed CVE-2026-6987, a high-severity command injection vulnerability affecting PicoClaw up to version 0.2.4. This flaw resides within an unspecified function of the /api/gateway/restart endpoint, part of the Web Launcher Management Plane component. Attackers can exploit this remotely without authentication.
Successful exploitation allows for arbitrary command execution on the underlying system, leading to potential data compromise, system takeover, or further network pivot points. The vulnerability is categorized under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Improper Neutralization of Special Elements used in a Command). The project maintainers were reportedly informed via an issue report but have not yet responded, leaving a window open for exploitation.
This is a critical remote code execution vector. Defenders must assume this vulnerability is actively exploitable given the lack of a patch and the straightforward nature of command injection. The CVSSv3.1 score of 7.3 (HIGH) accurately reflects the significant risk.
What This Means For You
- If your organization utilizes PicoClaw, immediately identify all instances running versions up to 0.2.4. Since no patch is available for CVE-2026-6987, isolate affected systems and implement strict network segmentation to limit potential attacker lateral movement. Monitor all traffic to and from PicoClaw instances for anomalous command execution attempts, especially targeting the `/api/gateway/restart` endpoint.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6987: PicoClaw Web Launcher Command Injection via /api/gateway/restart
title: CVE-2026-6987: PicoClaw Web Launcher Command Injection via /api/gateway/restart
id: scw-2026-04-25-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-6987 by sending POST requests to the /api/gateway/restart endpoint with parameters indicative of command injection. This is the primary detection for initial exploitation of the vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-04-25
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-6987/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
uri|contains:
- '/api/gateway/restart'
cs-method:
- 'POST'
cs-uri-query|contains:
- 'command='
- 'cmd='
- 'exec='
- 'payload='
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6987 | Command Injection | PicoClaw up to 0.2.4 |
| CVE-2026-6987 | Command Injection | /api/gateway/restart |
| CVE-2026-6987 | Command Injection | Web Launcher Management Plane component |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 25, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6994 — A weakness has been identified in Envoy up to 1.33.0.
CVE-2026-6994 — A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_mutation/header_mutation.cc of the component Query...
CVE-2026-6993 — Go-Kratos Kratos Vulnerability
CVE-2026-6993 — A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the...
Linksys MR9600 RCE: Critical OS Command Injection Vulnerability
CVE-2026-6992 — A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/init.d/run_central2.sh of the component JNAP Action Handler....