ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-75481

SkyPilot Authentication Bypass via Service Account Role Escalation

CVSS 4.0 8.7 HIGHCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-75481

Published

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-75481

Published

skypilot

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "skypilot-org",
                    "product": "skypilot",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/skypilot",
                    "repo": "https://github.com/skypilot-org/skypilot",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "0.13.1rc1",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON