CVE-2026-8634
Crabbox < v0.12.0 Environment Variable Information Disclosure
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 14, 2026
- Updated
- Oct 8, 2026
- Reserved
- May 14, 2026
Description
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
crabboxopenclaw |
|
References
- https://github.com/openclaw/crabbox/releases/tag/v0.12.0release-notes
- https://github.com/openclaw/crabbox/pull/78issue-tracking
- https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6fpatch
- https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.