EUVD-2026-60393
GHSA-9fgc-w437-4h52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privilege SkyPilot credentials
-
DeliveryAuthenticate to SkyPilot API server
-
ExploitCreate new service account via API
-
ExecutionSubmit permission update assigning admin role (no server-side check)
-
PersistReceive admin-scoped bearer token
-
ImpactAdminister all users and workspaces
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid SkyPilot user credential at any privilege level; the CVSS 4.0 PR:L metric confirms authenticated access is the sole prerequisite. No special deployment configuration, non-default feature flag, or specific platform version is required - the service account creation and role assignment APIs are standard platform functionality available to all authenticated users. Exploitation is limited by the credential requirement: purely unauthenticated external attackers cannot exploit this directly. The attack surface includes all authenticated insiders, credential-compromised accounts, and any user who completed standard SkyPilot onboarding in a multi-tenant deployment. There is no user interaction requirement and no network-level constraint beyond reaching the API server. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately characterizes this vulnerability: network-reachable, low complexity, no attack requirements beyond a valid user credential, and full compromise of confidentiality, integrity, and availability within the SkyPilot system. The exploit path is deterministic - any authenticated user follows the same sequence with no environmental variability - making it readily automatable. The principal limiting factor is PR:L: purely external, unauthenticated actors cannot exploit this directly, constraining the attack surface to insiders, credential-compromised accounts, and any registered SkyPilot user in multi-tenant deployments. No EPSS data was provided and this CVE is not listed in CISA KEV, so widespread exploitation is unconfirmed; however, the low technical barrier and high post-exploitation impact make this a real priority for any organization running a multi-user SkyPilot deployment. CVSS signals and description are consistent - no conflicting data detected. |
| Exploit ScenarioDerived | A low-privileged user authenticated to a multi-user SkyPilot deployment calls the service account creation API to register a new service account, then immediately calls the permission update endpoint specifying the admin role - a request the pre-patch server accepts without checking the caller's own role. The attacker authenticates subsequent API requests using the returned bearer token, now holding full administrative control over all SkyPilot users, workspaces, and cloud job configurations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Service account role escalation in SkyPilot grants any authenticated user full administrative control by exploiting missing authorization enforcement on the permission update API. The server-side handler in sky/users/server.py accepted admin role assignments from any valid user without verifying the caller held admin privileges - a direct CWE-269 (Improper Privilege Management) failure. All versions are affected per wildcard CPE; a patch commit is available upstream but no formally tagged release has been confirmed. No active exploitation is confirmed at time of analysis.
RemediationAI
Apply upstream patch commit 8a3e00259cd374e662cd876c037164bcb070f78e from https://github.com/skypilot-org/skypilot/commit/8a3e00259cd374e662cd876c037164bcb070f78e, which introduces _check_role_grantable() and _clamped_default_role() to enforce caller-privilege validation before any role grant. A formally tagged patched release version is not confirmed in available data - verify the fix is included in whichever release or HEAD commit your deployment targets. As an interim compensating control, restrict access to the service account permission update API endpoint to administrator-only network segments or apply an API gateway policy blocking non-admin principals from that route; the trade-off is disruption to any legitimate service account provisioning workflows performed by non-admin users. Immediately audit all existing service accounts for unauthorized admin role assignments and rotate bearer tokens for any that were escalated; the VulnCheck advisory at https://www.vulncheck.com/advisories/skypilot-authentication-bypass-via-service-account-role-escalation provides additional remediation context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SkyPilot (cpe:2.3:a:skypilot-org:skypilot:*:*:*:*:*:*:*:*) is an open-source framework for running AI/ML and LLM workloads across cloud providers, implementing a role-based access control (RBAC) system across sky/users/permission.py, sky/users/rbac.py, and sky/users/server.py. The root cause (CWE-269: Improper Privilege Management) is that the permission update endpoint in server.py lacked any caller-privilege check before writing role grants. The patch introduces _check_role_grantable(), which validates that only an admin (roles == ['admin'] exactly) can grant the admin role, and _clamped_default_role(), which caps service account default roles at the creator's own privilege ceiling to prevent indirect escalation via omitted role parameters. Before the fix, the RBAC enforcement layer in permission.py and rbac.py was correctly structured, but the server-side entry point never invoked authorization checks before forwarding role assignments, making the RBAC model a defense that was bypassed at the API boundary.
Know when Skypilot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network API requires only authenticated user (PR:L); privilege escalation stays within SkyPilot system boundary (S:U) but yields full admin control (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
Executive ViewAI
SkyPilot's service account management system contains a privilege escalation vulnerability (CVE-2026-75481, CVSS 8.7) that allows any authenticated user to escalate to full administrator privileges without authorization. No public exploit identified at time of analysis. Organizations using SkyPilot must patch immediately to prevent unauthorized administrative access to critical account infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB