CVE-2026-8621: OpenClaw header spoofing bypasses

CISO Take

Crabbox, an AI agent lease/coordination service, fails to derive caller identity from the shared token itself — instead it trusts client-supplied X-Crabbox-Owner and X-Crabbox-Org headers, so any non-admin holder of a valid shared token can simply set those headers to a victim's values and access that victim's owner- or org-scoped lease operations. This is a textbook CWE-287 authorization bypass rated CVSS 8.8 (network, low complexity, low privileges, no user interaction, full confidentiality/integrity/availability impact), and it lands in a package with a troubling track record: 447 other recorded CVEs and a 0/100 package risk score, meaning Crabbox deployments are already a soft target. EPSS is currently low (0.36%) and there is no CISA KEV listing, public exploit, or Nuclei template, so this is not being mass-exploited today, but the bug is trivial to weaponize — it requires nothing more than adding two headers — and any multi-tenant Crabbox deployment sharing one token across owners/orgs is exposed right now. Patch to Crabbox v0.12.0+ immediately (fix commit b657323f), and until upgraded, strip or reject client-supplied X-Crabbox-Owner/X-Crabbox-Org headers at the reverse proxy for any shared-token-authenticated route, then audit lease-operation logs for owner/org values inconsistent with the presenting token's scope.

Sources: NVD EPSS ATLAS vulncheck.com

What is the risk?

High severity (CVSS 8.8) with trivial exploitation mechanics: anyone already holding a low-privilege shared token can escalate to full cross-tenant access with a single crafted header, no user interaction and no special tooling required. Current exploitation likelihood is low per EPSS (0.36th percentile score, though flagged in the top 72% most-likely band relative to the broader CVE corpus) and there is no KEV listing, public PoC, or Nuclei coverage yet, which limits near-term opportunistic risk. However, the flaw is easily rediscoverable from the public patch diff, and Crabbox's poor security history (447 prior CVEs, 0/100 OpenSSF-style risk score) suggests weak engineering hygiene overall — treat this as high risk in any deployment using shared tokens across multiple owners/orgs, and as informational-only in single-tenant deployments where no cross-owner boundary exists.

How does the attack unfold?

Shared token acquisition

Attacker obtains or already holds a valid non-admin shared token for the multi-tenant Crabbox deployment.

AML.T0012

Header spoofing

Attacker adds crafted X-Crabbox-Owner and X-Crabbox-Org headers to requests authenticated with their shared token, targeting a victim owner/org.

AML.T0049

Cross-tenant authorization bypass

Crabbox trusts the client-supplied headers over token-derived identity and grants access scoped to the victim's owner/org.

AML.T0073

Unauthorized lease manipulation

Attacker reads, hijacks, or releases the victim's AI agent leases, exposing operational data or disrupting the victim's agent task scheduling.

Shared token acquisition

Attacker obtains or already holds a valid non-admin shared token for the multi-tenant Crabbox deployment.

AML.T0012

Header spoofing

Attacker adds crafted X-Crabbox-Owner and X-Crabbox-Org headers to requests authenticated with their shared token, targeting a victim owner/org.

AML.T0049

Cross-tenant authorization bypass

Crabbox trusts the client-supplied headers over token-derived identity and grants access scoped to the victim's owner/org.

AML.T0073

Unauthorized lease manipulation

Attacker reads, hijacks, or releases the victim's AI agent leases, exposing operational data or disrupting the victim's agent task scheduling.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade to Crabbox v0.12.0 or later immediately (patch commit b657323f1d1c954cefc8444571fa6c45a8896e7f). 2) If immediate upgrade isn't possible, strip or reject client-supplied X-Crabbox-Owner and X-Crabbox-Org headers at the reverse proxy/gateway for any route reachable with a shared token, forcing identity to be derived server-side from the token itself. 3) Rotate shared tokens post-patch, since they may have already been used for cross-tenant access. 4) Audit historical lease-operation logs for requests where the owner/org header doesn't match the presenting token's assigned scope — this is the forensic signature of exploitation. 5) Where supported, migrate from shared tokens to per-owner scoped tokens to remove the shared-secret blast radius entirely. 6) Given the package's 447 prior CVEs, subscribe to the GitHub releases/advisories for Crabbox and re-triage on every future patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0073 - Impersonation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security controls / access management

NIST AI RMF

MANAGE-4.1 - Risk treatment for AI system access and use

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-8621?

Crabbox, an AI agent lease/coordination service, fails to derive caller identity from the shared token itself — instead it trusts client-supplied X-Crabbox-Owner and X-Crabbox-Org headers, so any non-admin holder of a valid shared token can simply set those headers to a victim's values and access that victim's owner- or org-scoped lease operations. This is a textbook CWE-287 authorization bypass rated CVSS 8.8 (network, low complexity, low privileges, no user interaction, full confidentiality/integrity/availability impact), and it lands in a package with a troubling track record: 447 other recorded CVEs and a 0/100 package risk score, meaning Crabbox deployments are already a soft target. EPSS is currently low (0.36%) and there is no CISA KEV listing, public exploit, or Nuclei template, so this is not being mass-exploited today, but the bug is trivial to weaponize — it requires nothing more than adding two headers — and any multi-tenant Crabbox deployment sharing one token across owners/orgs is exposed right now. Patch to Crabbox v0.12.0+ immediately (fix commit b657323f), and until upgraded, strip or reject client-supplied X-Crabbox-Owner/X-Crabbox-Org headers at the reverse proxy for any shared-token-authenticated route, then audit lease-operation logs for owner/org values inconsistent with the presenting token's scope.

Is CVE-2026-8621 actively exploited?

No confirmed active exploitation of CVE-2026-8621 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-8621?

1) Upgrade to Crabbox v0.12.0 or later immediately (patch commit b657323f1d1c954cefc8444571fa6c45a8896e7f). 2) If immediate upgrade isn't possible, strip or reject client-supplied X-Crabbox-Owner and X-Crabbox-Org headers at the reverse proxy/gateway for any route reachable with a shared token, forcing identity to be derived server-side from the token itself. 3) Rotate shared tokens post-patch, since they may have already been used for cross-tenant access. 4) Audit historical lease-operation logs for requests where the owner/org header doesn't match the presenting token's assigned scope — this is the forensic signature of exploitation. 5) Where supported, migrate from shared tokens to per-owner scoped tokens to remove the shared-secret blast radius entirely. 6) Given the package's 447 prior CVEs, subscribe to the GitHub releases/advisories for Crabbox and re-triage on every future patch.

What systems are affected by CVE-2026-8621?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent infrastructure, distributed lease/lock coordination.

What is the CVSS score for CVE-2026-8621?

CVE-2026-8621 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant agent infrastructuredistributed lease/lock coordination

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0073 Impersonation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.

Exploitation Scenario

An attacker (e.g., a lower-trust contractor, a compromised low-privilege service, or a malicious tenant) holds a valid but non-admin shared token issued for a multi-tenant Crabbox deployment. Rather than presenting their own owner/org context, they add X-Crabbox-Owner: <victim-owner-id> and X-Crabbox-Org: <victim-org-id> headers to their API requests. Because Crabbox authorizes lease operations based on these client-supplied headers instead of identity derived from the token, the request is granted as if it came from the victim. The attacker can now enumerate, acquire, or release leases belonging to the victim's AI agent fleet — stalling the victim's agent task scheduling (denial of service), reading lease metadata that leaks operational details about the victim's agent workloads, or hijacking locks to interfere with in-flight agent operations.

Weaknesses (CWE)

CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.