Crabbox CVE-2026-8621

Attacker must possess a valid shared token (low-privilege authentication credential) for any account in the Crabbox instance. The vulnerability affects deployments using shared-token authentication for multi-tenant or organizational access control - installations using only individual per-user tokens without organizational scoping may have reduced exposure. Exploitation is network-based (AV:N) with no additional complexity (AC:L), no user interaction required (UI:N), and does not require administrative privileges. The spoofing attack works against default configurations of Crabbox versions prior to v0.12.0 that rely on X-Crabbox-Owner and X-Crabbox-Org headers for authorization scoping. Limiting factor: attacker must first obtain a valid shared token through credential theft, phishing, or insider access, but once obtained, lateral movement to any owner/org is unrestricted.

Real-world risk is HIGH for multi-tenant Crabbox deployments using shared tokens. CVSS 8.7 accurately reflects the severe authorization bypass - attackers with any valid shared token can pivot to full owner/organization impersonation. The PR:L (low privileges required) and AC:L (low complexity) metrics confirm this is straightforward to exploit once an attacker obtains any shared-token credential. The scope is unchanged (S:U in implicit CVSS 3.x mapping), meaning impact is contained within the Crabbox application boundary, but VC:H/VI:H/VA:H indicates complete compromise of lease data and operations for victim accounts. No EPSS score provided, but the combination of simple header injection, low attack complexity, and vendor-confirmed patch suggests opportunistic scanning is likely if Crabbox instances are internet-exposed. Not present in CISA KEV, indicating no confirmed widespread exploitation at time of publication. Publicly available exploit code status unknown - the VulnCheck advisory and GitHub commit provide sufficient technical detail for proof-of-concept development. Priority is IMMEDIATE for any organization using shared tokens in production, as this enables lateral movement between organizational tenants.

An attacker obtains a valid shared token for a low-privilege team member account in Organization A. They issue an API request to create, modify, or delete compute leases, but inject HTTP headers X-Crabbox-Owner: victim-user and X-Crabbox-Org: target-org-b. The Crabbox API trusts these spoofed headers without validating them against the shared token's actual permissions, granting the attacker full lease management capabilities under the victim's identity in Organization B. The attacker exfiltrates sensitive data from victim workloads, deploys malicious infrastructure under the victim's billing account, or disrupts production leases. Publicly available exploit code status unknown, but the vulnerability is straightforward header injection requiring only HTTP client manipulation.