CVE-2026-45223
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Crabbox before version 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges.
Risk Assessment
An attacker with access to a shared non-admin token can gain full coordinator admin access, including lease visibility, pool state management, and forced release operations.
Recommendation
Immediately update Crabbox to version 0.9.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Crabbox
See all- CVE-2026-8634Critical
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
- CVE-2026-8629High
A privilege escalation vulnerability in Crabbox prior to v0.12.0 allows users with visibility-only access to obtain Code, WebVNC, and Egress agent tickets via POST requests. Attackers can exploit insufficient access controls on ticket endpoints to impersonate trusted lease-side bridges.
- CVE-2026-8621High
An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.
- CVE-2026-45224High
Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.
Original NVD description (English source)
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.