Weak Hash Vulnerability in SkyPilot User ID Handler by skypilot-org

CVE-2026-13482

What is CVE-2026-13482?

A vulnerability has been identified in the User ID Handler of SkyPilot, specifically in the function username.encode located within the file sky/users/server.py. This flaw permits the use of weak hashing algorithms, potentially leading to the exposure of sensitive user identifiers. The attack can be executed remotely, characterized by its complexity, which may hinder exploitation. The vulnerability has been made public, and the vendor was notified prior to the disclosure.

References