Crabbox CVE-2026-8629

Exploitation requires the target Crabbox deployment to have implemented multi-tier permission models where some authenticated users are granted visibility-only access to leases owned or controlled by other users. The attacker must possess valid low-privilege credentials (PR:L per CVSS vector) with at least read/visibility permissions to at least one lease resource. The vulnerable ticket endpoints must be network-accessible to the authenticated user (AV:N), which is the default configuration for API-driven Crabbox deployments. No user interaction (UI:N) is required beyond the attacker's own actions. Organizations running Crabbox in single-user mode or where all authenticated users have equivalent full-control permissions are not exploitable through this vulnerability, as the privilege escalation path only exists when permission hierarchies are enforced. The vulnerability does NOT require: non-default configurations, specific lease provider types (AWS/Azure/Proxmox), or special network positioning beyond normal API client access.

Real-world risk is High for multi-tenant Crabbox deployments with shared visibility models. CVSS 8.6 accurately reflects the technical severity: network attack vector (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and high confidentiality/integrity impacts (VC:H/VI:H) with no availability impact (VA:N). The Changed scope metrics (SC:N/SI:N/SA:N) indicate the attacker remains within the vulnerable component's authorization boundary rather than pivoting to separate systems. EPSS data is unavailable, but the straightforward exploitation path (simple POST requests to documented API endpoints) suggests high exploitability for authenticated insiders or compromised low-privilege accounts. The vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation in the wild at time of analysis. The patch is available with an exact fix version (v0.12.0, commit 95cb30dc7dbaa1fef690a42ef6ac1cb6e307a191) released 2026-05-12, providing clear remediation. The SSVC decision framework indicates moderate urgency: exploitation requires authentication (not fully automatable), technical impact is total (code execution + data access), but no evidence of active exploitation reduces immediate priority below internet-facing unauthenticated RCE. Organizations using Crabbox in single-user or fully-trusted-team environments face lower practical risk than those with hierarchical permission models where visibility-only access is granted to less-trusted users or external auditors.

An attacker with legitimate visibility-only access to a Crabbox lease (for example, a junior developer granted read-only monitoring permissions to a production environment) sends authenticated POST requests to /v1/leases/:id/code/ticket using the lease ID from their permitted scope. The vulnerable endpoint returns a valid bridge-agent ticket without verifying the user's permission level. The attacker uses this ticket to establish a remote shell session to the lease instance, gaining full code execution as if they were the lease owner. They repeat the process with /v1/leases/:id/egress/ticket to obtain data exfiltration access, allowing them to extract sensitive environment variables, credentials, or application data from the compromised lease. The attack leaves minimal traces beyond normal API activity since the attacker uses their legitimate credentials throughout.