EUVD-2026-39982
GHSA-mh3f-459p-p84f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but high complexity; PR:N per CVSS 4.0; C:L added to reflect VulDB Information Disclosure tag suggesting hash reversibility; I:L for integrity manipulation; no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component User ID Handler. The manipulation results in use of weak hash. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
Weak hash usage in SkyPilot's User ID Handler (versions up to 0.12.0) allows remote attackers with high-complexity access to manipulate user identity integrity by exploiting the username.encode function in sky/users/server.py. The vulnerability (CWE-328) results in a low-integrity impact on the vulnerable system, with no confidentiality or availability impact per the CVSS 4.0 vector, though the VulDB-assigned 'Information Disclosure' tag suggests the weak hash may additionally expose derivable username data. A public exploit exists (CVSS 4.0 E:P modifier confirmed), but no confirmed active exploitation or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
SkyPilot (cpe:2.3:a:skypilot-org:skypilot:*:*:*:*:*:*:*:*) is an open-source ML/AI infrastructure orchestration framework used for running workloads across cloud providers. The affected component is the User ID Handler located at sky/users/server.py, specifically in the username.encode function responsible for generating or encoding user identifiers. CWE-328 (Use of Weak Hash) describes situations where an application relies on a hash algorithm that is cryptographically insecure - such as MD5, SHA-1, or a custom weak implementation - making the hash susceptible to preimage attacks, collision attacks, or brute-force reversal. In a user identity context, a weak hash could allow an attacker to forge, predict, or collide user IDs, undermining the integrity of the identity management subsystem.
RemediationAI
No vendor-released patched version has been independently confirmed from the available references at time of analysis. Users should monitor the GitHub issue at https://github.com/skypilot-org/skypilot/issues/9194 and the VulDB entry at https://vuldb.com/cve/CVE-2026-13482 for patch availability updates. As a compensating control, operators should restrict network access to the SkyPilot server's user management endpoints using firewall rules or network segmentation, preventing unauthenticated remote access to the vulnerable username.encode pathway - note this reduces exposure but does not eliminate the weak hash flaw for users with legitimate access. Additionally, administrators should audit user ID generation logic in their SkyPilot deployments and, if customization is possible, replace the weak hashing mechanism with a cryptographically strong algorithm such as SHA-256 or bcrypt. Downgrading or isolating the deployment from public network exposure is advisable until a patched release is confirmed.
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today