CVE-2026-8621
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.
Risk Assessment
Attackers can gain unauthorized access to owner/org-scoped lease operations, leading to data confidentiality and integrity breaches and potential resource theft.
Recommendation
Upgrade Crabbox to version 0.12.0 or later immediately. Until then, restrict trust in shared tokens and implement additional header validation.
Other vulnerabilities in Crabbox
See all- CVE-2026-8634Critical
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
- CVE-2026-8629High
A privilege escalation vulnerability in Crabbox prior to v0.12.0 allows users with visibility-only access to obtain Code, WebVNC, and Egress agent tickets via POST requests. Attackers can exploit insufficient access controls on ticket endpoints to impersonate trusted lease-side bridges.
- CVE-2026-45224High
Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.
- CVE-2026-45223High
Crabbox before version 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges.
Original NVD description (English source)
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.