Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: openclaw crabbox 0.12.0 Clear all filters
TI-2026-07590 CVE-2026-8634 · GHSA-fm77-94qm-4894

Crabbox < v0.12.0 Environment Variable Information Disclosure

Priority HIGH 81

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials,…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00955 Published 2026-05-14 Fixed in 0.12.0 CWE-94
TI-2026-07585 CVE-2026-8629 · GHSA-23m9-rr4p-xpwh

Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints

Priority HIGH 72

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00338 Published 2026-05-14 Fixed in 0.12.0 CWE-639
TI-2026-07577 CVE-2026-8621 · GHSA-4g9m-rffv-h6wq

Crabbox < v0.12.0 Authentication Bypass via Header Spoofing

Priority MEDIUM 40

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00361 Published 2026-05-14 Fixed in 0.12.0 CWE-287