CVE-2026-8634
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.
Risk Assessment
The risk involves unauthorized disclosure of sensitive organizational credentials, potentially leading to account takeover, data theft, or further attacks on cloud infrastructure and broker systems.
Recommendation
Immediately upgrade Crabbox to version 0.12.0 or later, and review and tighten environment variable allowlisting rules in repository configurations to restrict access to only necessary variables.
Original NVD description (English source)
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.