CVE-2026-75481
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and gain administrative control over all users and workspaces.
Risk Assessment
An attacker can gain full control over the platform, leading to complete compromise of data and resources.
Recommendation
Update SkyPilot to a patched version and implement proper permission controls.
Original NVD description (English source)
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.