GitHub Advisoryadvisory · Go

GHSA-4g9m-rffv-h6wq Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers

HIGH Published 2026-05-14 Modified 2026-05-21 Official page ↗
Aliases
CVE-2026-8621
Ecosystem
Go
Packages
github.com/openclaw/crabbox
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2026-05-21

Affected packages

• Go github.com/openclaw/crabbox: < 0.12.0 → fixed in 0.12.0

Description

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.

Related

Alias · CVE (1)

  • CVE-2026-8621 Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References