Privilege Escalation Vulnerability in Crabbox by OpenClaw

CVE-2026-8629

What is CVE-2026-8629?

Crabbox versions before 0.12.0 are susceptible to a privilege escalation vulnerability that permits users with merely visibility permissions to access Code, WebVNC, and Egress agent tickets. By exploiting weak access control measures on various ticket endpoints, such as /v1/leases/:id/code/ticket and others, attackers can impersonate legitimate lease-side bridges. This flaw exposes critical components to unauthorized actions, highlighting the need for enhanced access control and timely updates.

References