SkyPilot CVE-2026-13482

The attack requires high complexity (AC:H per CVSS 4.0), meaning specific preconditions or timing constraints must be met - the exact technical prerequisites are not enumerated in the available description beyond the requirement to target the username.encode function in the User ID Handler. No authentication is required (PR:N), meaning the attack is accessible to unauthenticated remote actors who can reach the SkyPilot server over the network. Exploitation is limited by the high attack complexity, which the description explicitly characterizes as 'difficult,' implying either that specific knowledge of the hash algorithm in use is needed, that a race condition or precise input manipulation is required, or that hash collision feasibility depends on the specific weak algorithm deployed. No specific non-default configuration setting is identified as a prerequisite. Impact is bounded to low integrity manipulation with no confirmed confidentiality or availability impact per CVSS 4.0 (VC:N/VI:L/VA:N).

The CVSS 4.0 score of 6.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/E:P) reflects a moderate-severity issue constrained by high attack complexity (AC:H), which meaningfully reduces real-world exploitability. The description explicitly characterizes the exploitability as 'difficult,' aligning with AC:H. Impact is bounded to low integrity (VI:L) on the vulnerable system with no confidentiality or availability impact in the CVSS 4.0 vector, though the VulDB 'Information Disclosure' tag introduces a minor discrepancy - this may reflect that username hashes could be derived or reversed. The E:P modifier confirms a public exploit exists, elevating practical urgency beyond what the base score alone suggests. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. The absence of a CISA KEV listing suggests no confirmed mass exploitation. Overall, this is a real but bounded risk: the public exploit is a genuine concern for SkyPilot deployments, but the high complexity and narrow integrity-only impact reduce the immediate blast radius compared to a critical RCE vulnerability.

A remote attacker with the capability to interact with SkyPilot's user management interface could craft requests that exploit hash collisions or preimage weaknesses in the username.encode function to forge or predict valid user identifiers. If successful, the attacker could manipulate user identity resolution within the system, potentially causing requests to be attributed to a different user account and subverting access control or audit logging. A public exploit for this technique has been disclosed, lowering the barrier for motivated attackers despite the high attack complexity.