CVE-2026-8634
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
Risk Assessment
The risk involves unauthorized disclosure of sensitive organizational credentials, potentially leading to account takeover, data theft, or further attacks on cloud infrastructure and broker systems.
Recommendation
Immediately upgrade Crabbox to version 0.12.0 or later, and review and tighten environment variable allowlisting rules in repository configurations to restrict access to only necessary variables.
Other vulnerabilities in Crabbox
See all- CVE-2026-8629High
A privilege escalation vulnerability in Crabbox prior to v0.12.0 allows users with visibility-only access to obtain Code, WebVNC, and Egress agent tickets via POST requests. Attackers can exploit insufficient access controls on ticket endpoints to impersonate trusted lease-side bridges.
- CVE-2026-8621High
An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.
- CVE-2026-45224High
Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.
- CVE-2026-45223High
Crabbox before version 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges.
Original NVD description (English source)
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS