CVE-2026-8634 Details
Description
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
A vulnerability exists in Crabbox versions prior to 0.12.0, allowing for the exposure of environment variables. This issue enables attackers with access to a compromised repository to forward local secrets, such as API tokens and cloud credentials, into the remote command environment. The vulnerability arises from overly permissive environment variable allowlisting in repository-specific Crabbox configurations, which can serialize sensitive data into remote command executions, thereby exposing credentials in the remote environment.
Users can update to Crabbox version 0.13.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/crabbox/pull/78 | CISA-ADP | Issue TrackingVendor |
| https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f | [email protected] | Source CodeVendor |
| https://github.com/openclaw/crabbox/pull/78 | [email protected] | Issue TrackingVendor |
| https://github.com/openclaw/crabbox/releases/tag/v0.12.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw Crabbox | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |