{"id":"EUVD-2026-30369","enisaUuid":"5f621aa2-6bb4-31f7-a2f4-6fb412d63808","description":"Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.","datePublished":"May 14, 2026, 6:46:43 PM","dateUpdated":"Oct 8, 2026, 3:25:49 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/crabbox/releases/tag/v0.12.0\nhttps://github.com/openclaw/crabbox/pull/70\nhttps://github.com/openclaw/crabbox/commit/b657323f1d1c954cefc8444571fa6c45a8896e7f\nhttps://www.vulncheck.com/advisories/crabbox-authentication-bypass-via-header-spoofing\n","aliases":"CVE-2026-8621\nGHSA-4g9m-rffv-h6wq\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"b395760c-5154-30dc-a0e2-ae15b1fe949f","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c0.12.0"},{"id":"fd97ea9a-4f7d-3d48-b94a-2b6e6a631b50","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"patch: b657323f1d1c954cefc8444571fa6c45a8896e7f"}],"enisaIdVendor":[{"id":"15b0c09c-b565-3e7f-9350-c12aafce6a8c","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"00c22b89-eb18-3752-b895-b32524cb51ae","vulnerability":{"id":"GHSA-4g9m-rffv-h6wq","description":"Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers","datePublished":"May 14, 2026, 9:30:43 PM","dateUpdated":"May 21, 2026, 7:29:07 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-8621\nhttps://github.com/openclaw/crabbox/pull/70\nhttps://github.com/openclaw/crabbox/commit/b657323f1d1c954cefc8444571fa6c45a8896e7f\nhttps://github.com/openclaw/crabbox\nhttps://github.com/openclaw/crabbox/releases/tag/v0.12.0\nhttps://www.vulncheck.com/advisories/crabbox-authentication-bypass-via-header-spoofing\n","enisa_id":"EUVD-2026-30369\n","aliases":"CVE-2026-8621\nGHSA-4g9m-rffv-h6wq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d02cb16f-290e-3d1f-a0b2-93eb439b2292","vulnerability":{"id":"CVE-2026-8621","description":"Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.","datePublished":"May 14, 2026, 6:46:43 PM","dateUpdated":"Oct 8, 2026, 3:25:49 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/crabbox/releases/tag/v0.12.0\nhttps://github.com/openclaw/crabbox/pull/70\nhttps://github.com/openclaw/crabbox/commit/b657323f1d1c954cefc8444571fa6c45a8896e7f\nhttps://www.vulncheck.com/advisories/crabbox-authentication-bypass-via-header-spoofing\n","enisa_id":"EUVD-2026-30369\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Oct 28, 2026, 7:17:45 AM","vulnerabilityProduct":[{"id":"579ef5ef-84c5-3cfb-8f80-7e98caeb9a08","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"patch: b657323f1d1c954cefc8444571fa6c45a8896e7f"},{"id":"62ee60cf-a754-3858-be4f-eb4623532edd","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c0.12.0"}],"vulnerabilityVendor":[{"id":"745cc068-95ad-34c3-adc5-fbb715c24ded","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[]}