CVE-2026-45223: OpenClaw coordinator auth bypass

CISO Take

Crabbox's coordinator fails to validate that a signed user-token payload doesn't carry an unauthorized admin claim, so anyone holding the shared non-admin token can forge an admin:true payload and gain full coordinator control. This matters for AI agent deployments where crabbox coordinates worker pools and task leases: an attacker who escalates to coordinator-admin can view all active leases, manipulate pool state, and force-release tasks mid-execution, effectively hijacking the orchestration layer with no user interaction and low attack complexity (CVSS 8.8). Exploitation likelihood currently sits in the top 70th percentile by EPSS (0.4%) with no public exploit, Nuclei template, or CISA KEV listing — plausible but not yet observed in the wild — though the package's 447 other CVEs and 0/100 risk score point to broader maintenance concerns. Upgrade to crabbox 0.9.0+ immediately, rotate all shared coordinator tokens post-upgrade, and audit coordinator logs for user-token payloads carrying unexpected admin claims.

Sources: NVD EPSS GitHub VulnCheck ATLAS

What is the risk?

High risk despite modest EPSS. The vulnerability requires only low privileges (possession of the shared non-admin token, which is likely distributed to every worker/agent in the pool), no user interaction, and low attack complexity over the network — a near-ideal exploitation profile. Impact is complete: confidentiality, integrity, and availability are all rated high because the flaw grants full coordinator-admin rights rather than a narrow information leak. The main mitigating factor is that no public exploit or scanner template exists yet and it isn't in CISA KEV, so this is currently a disclosed-but-not-weaponized bug — the window to patch before that changes is the operative risk window.

How does the attack unfold?

Token Acquisition

Attacker obtains the shared non-admin coordinator token already distributed to legitimate low-privilege workers/agents in the pool.

AML.T0012

Forge Admin Claim

Attacker crafts a user-token payload adding admin: true and signs it with the same HMAC-SHA256 secret, exploiting verifyUserToken()'s failure to reject unauthorized admin claims.

AML.T0107

Present to Admin Routes

The forged token is submitted to network-facing, admin-only coordinator endpoints, which accept it as valid.

AML.T0049

Coordinator Takeover

Attacker gains full coordinator admin access — viewing all active leases, altering pool state, and force-releasing tasks — disrupting the AI agent orchestration layer.

AML.T0029

Token Acquisition

Attacker obtains the shared non-admin coordinator token already distributed to legitimate low-privilege workers/agents in the pool.

AML.T0012

Forge Admin Claim

Attacker crafts a user-token payload adding admin: true and signs it with the same HMAC-SHA256 secret, exploiting verifyUserToken()'s failure to reject unauthorized admin claims.

AML.T0107

Present to Admin Routes

The forged token is submitted to network-facing, admin-only coordinator endpoints, which accept it as valid.

AML.T0049

Coordinator Takeover

Attacker gains full coordinator admin access — viewing all active leases, altering pool state, and force-releasing tasks — disrupting the AI agent orchestration layer.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade crabbox to 0.9.0 or later immediately (patch commit 46079f6, PR #64). 2) After upgrading, rotate all shared coordinator tokens/HMAC secrets — the forged-token technique means any previously issued non-admin token should be considered potentially abusable until reissued under the fixed verification logic. 3) Where possible, separate signing keys/claims for admin vs. non-admin tokens rather than relying on a single shared secret with a boolean claim. 4) Monitor coordinator logs for user-token payloads containing an admin claim from tokens not provisioned as admin, and alert on unexpected forced-release or pool-state-change operations. 5) Restrict network exposure of coordinator admin routes (e.g., internal-only network segment) as defense in depth.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1 - AI system security incidents and vulnerabilities are monitored and responded to

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-45223?

Crabbox's coordinator fails to validate that a signed user-token payload doesn't carry an unauthorized admin claim, so anyone holding the shared non-admin token can forge an admin:true payload and gain full coordinator control. This matters for AI agent deployments where crabbox coordinates worker pools and task leases: an attacker who escalates to coordinator-admin can view all active leases, manipulate pool state, and force-release tasks mid-execution, effectively hijacking the orchestration layer with no user interaction and low attack complexity (CVSS 8.8). Exploitation likelihood currently sits in the top 70th percentile by EPSS (0.4%) with no public exploit, Nuclei template, or CISA KEV listing — plausible but not yet observed in the wild — though the package's 447 other CVEs and 0/100 risk score point to broader maintenance concerns. Upgrade to crabbox 0.9.0+ immediately, rotate all shared coordinator tokens post-upgrade, and audit coordinator logs for user-token payloads carrying unexpected admin claims.

Is CVE-2026-45223 actively exploited?

No confirmed active exploitation of CVE-2026-45223 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-45223?

1) Upgrade crabbox to 0.9.0 or later immediately (patch commit 46079f6, PR #64). 2) After upgrading, rotate all shared coordinator tokens/HMAC secrets — the forged-token technique means any previously issued non-admin token should be considered potentially abusable until reissued under the fixed verification logic. 3) Where possible, separate signing keys/claims for admin vs. non-admin tokens rather than relying on a single shared secret with a boolean claim. 4) Monitor coordinator logs for user-token payloads containing an admin claim from tokens not provisioned as admin, and alert on unexpected forced-release or pool-state-change operations. 5) Restrict network exposure of coordinator admin routes (e.g., internal-only network segment) as defense in depth.

What systems are affected by CVE-2026-45223?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, task queue / worker pool orchestration.

What is the CVSS score for CVE-2026-45223?

CVE-2026-45223 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstask queue / worker pool orchestration

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.

Exploitation Scenario

A worker or low-privilege agent participating in a crabbox-coordinated pool already holds the shared non-admin token used for routine coordinator calls. The attacker takes that token, constructs a new user-token JSON payload adding "admin": true, and signs it with HMAC-SHA256 using the same shared secret that verifyUserToken() accepts for non-admin tokens — because the function never checks whether the caller is authorized to assert the admin claim. The attacker submits this forged token to admin-only coordinator routes over the network. The coordinator accepts it as legitimate, granting the attacker visibility into all active leases across the pool, the ability to manipulate pool state (e.g., reassign or exhaust worker capacity), and the ability to force-release leases held by other agents — disrupting or corrupting in-progress orchestration and potentially exposing task metadata belonging to other workflows.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.