CVE-2026-8621: fallo de gravedad alta en openclaw crabbox
Crabbox < v0.12.0 Authentication Bypass via Header Spoofing
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.4%
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
openclaw · crabboxCVEs relacionadas — openclaw crabbox
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-8634CRITICALCrabbox < v0.12.0 Environment Variable Information DisclosureEPSS 1.0%CVE-2026-45223HIGHCrabbox < 0.9.0 Authentication Bypass via Admin Claim InjectionEPSS 0.4%CVE-2026-8629HIGHCrabbox < v0.12.0 Privilege Escalation via Agent Ticket EndpointsEPSS 0.3%CVE-2026-45224MEDIUMCrabbox < 0.9.0 Path Traversal via Islo Provider Workspace ResolutionEPSS 0.1%