CVE-2026-75481

HighCVSS 8.8

Published: 17/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and gain administrative control over all users and workspaces.

Risk Assessment

An attacker can gain full control over the platform, leading to complete compromise of data and resources.

Recommendation

Update SkyPilot to a patched version and implement proper permission controls.

Other vulnerabilities in SkyPilot

CVE-2026-13482Low
A vulnerability was found in skypilot up to version 0.12.0, affecting the username.encode function in sky/users/server.py of the User ID Handler component. Manipulation leads to use of weak hash, enabling a remote attack with high complexity.

Original NVD description (English source)

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS