CVE-2026-8629
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A privilege escalation vulnerability in Crabbox prior to v0.12.0 allows users with visibility-only access to obtain Code, WebVNC, and Egress agent tickets via POST requests. Attackers can exploit insufficient access controls on ticket endpoints to impersonate trusted lease-side bridges.
Risk Assessment
The organization faces unauthorized access to sensitive resources and potential takeover of bridge sessions, leading to data leakage or system integrity compromise.
Recommendation
Upgrade Crabbox to version 0.12.0 or later immediately, which includes access control fixes on ticket endpoints.
Other vulnerabilities in Crabbox
See all- CVE-2026-8634Critical
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
- CVE-2026-8621High
An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.
- CVE-2026-45224High
Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.
- CVE-2026-45223High
Crabbox before version 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges.
Original NVD description (English source)
Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.