Authentication Bypass Vulnerability in Crabbox by OpenClaw

CVE-2026-8621

What is CVE-2026-8621?

Crabbox versions prior to v0.12.0 are susceptible to an authentication bypass vulnerability that allows attackers to impersonate other owners or organizations. This is achieved through the injection of malicious headers, specifically X-Crabbox-Owner and X-Crabbox-Org, which circumvent existing authorization mechanisms. As a result, non-admin shared-token callers can inadvertently gain access to sensitive operations related to victim accounts, compromising the integrity and confidentiality of their data.

References