CVE-2026-8629: OpenClaw IDOR lets viewers hijack

CISO Take

Crabbox, a lease-based sandbox provider that brokers Code execution, WebVNC, and network-egress access for AI agent environments, fails to verify that a caller actually holds control permissions before issuing bridge-agent tickets — so any user with mere visibility-only access to a shared lease can POST directly to the ticket endpoints and receive credentials that let them impersonate the trusted Code, WebVNC, and Egress bridges. For a CISO, the real risk is what this breaks: teams that grant read-only 'observer' access to a running AI agent session for oversight, compliance review, or incident response are unknowingly handing those observers a path to full control — code execution, remote desktop interaction, and outbound network access — inside that agent's sandbox. Exploitation is close to trivial (CVSS 8.1, AV:N/AC:L/PR:L/UI:N — no more than crafting a few POST requests), though there is no CISA KEV listing, public exploit, or Nuclei template yet, and EPSS sits at just 0.34% (74th percentile), so opportunistic mass exploitation looks unlikely today; the exposure is narrower (4 known downstream dependents) but severe for any org actually using Crabbox to broker agent sandboxes. Patch to Crabbox v0.12.0 immediately (fix in commit 95cb30d / PR #71), and in the interim audit any lease shared with visibility-only collaborators — revoke or rotate those shares and monitor for POST requests to /v1/leases/:id/{code,webvnc,egress}/ticket from principals who shouldn't hold control tickets.

Sources: NVD EPSS CISA KEV GitHub Advisory vulncheck.com ATLAS

What is the risk?

HIGH risk despite currently limited exploitation signal. Exploitability is close to trivial: CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N) means a remote attacker only needs a low-privilege (viewer) account and a single crafted POST request — no user interaction, no chained preconditions. Impact is severe on confidentiality and integrity (C:H/I:H) since successful exploitation yields impersonation of trusted bridge agents controlling code execution, remote desktop, and network egress; availability is unaffected (A:N), so this is a control-hijack/data-exposure risk rather than a denial-of-service risk. Exposure signals are currently muted — not in CISA KEV, no public PoC, no Nuclei template, EPSS 0.00338 (74th percentile, below the range that typically indicates active or imminent mass exploitation). The package record also shows 447 other CVEs and an OpenSSF/package risk score of 0/100, which would normally flag weak security hygiene — but this count looks unusually high for a niche, 4-dependent package, so verify it isn't a namesake or aggregation artifact before treating it as a hygiene signal. Blast radius is contained (4 downstream dependents), making this a targeted but high-severity risk for organizations that have deployed Crabbox to broker AI agent sandbox access with mixed-permission sharing.

How does the attack unfold?

Legitimate but limited access

Attacker holds a valid but visibility-only account on a shared Crabbox lease (e.g., an observer role added for oversight).

AML.T0012

Ticket forgery via broken access control

Attacker sends direct POST requests to /v1/leases/:id/{code,webvnc,egress}/ticket; the server issues bridge-agent tickets without verifying the caller's role permits control actions.

AML.T0091.000

Bridge impersonation

Attacker presents the obtained tickets to impersonate the trusted Code, WebVNC, and Egress bridges for that lease, gaining operator-level channels.

AML.T0053

Sandbox takeover and exfiltration

Attacker executes arbitrary code, controls the remote desktop, and routes traffic through the sandbox's egress path to exfiltrate data or pivot to reachable internal resources.

AML.T0025

Legitimate but limited access

Attacker holds a valid but visibility-only account on a shared Crabbox lease (e.g., an observer role added for oversight).

AML.T0012

Ticket forgery via broken access control

Attacker sends direct POST requests to /v1/leases/:id/{code,webvnc,egress}/ticket; the server issues bridge-agent tickets without verifying the caller's role permits control actions.

AML.T0091.000

Bridge impersonation

Attacker presents the obtained tickets to impersonate the trusted Code, WebVNC, and Egress bridges for that lease, gaining operator-level channels.

AML.T0053

Sandbox takeover and exfiltration

Attacker executes arbitrary code, controls the remote desktop, and routes traffic through the sandbox's egress path to exfiltrate data or pivot to reachable internal resources.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade Crabbox to v0.12.0 or later (fix in commit 95cb30dc7dbaa1fef690a42ef6ac1cb6e307a191 / PR #71) immediately. After patching, audit all active lease shares and identify any principals holding visibility-only grants; revoke and reissue lease tickets for those shares as a precaution in case tickets were already obtained pre-patch. If self-hosting or fronting Crabbox with a custom control plane, add defense-in-depth authorization checks that independently verify caller role before proxying ticket requests. For detection, alert on calls to /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket from accounts whose lease role is visibility-only, and review bridge-connection audit logs for Code/WebVNC/Egress sessions not matching the lease owner's identity.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - AI system access control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-8629?

Crabbox, a lease-based sandbox provider that brokers Code execution, WebVNC, and network-egress access for AI agent environments, fails to verify that a caller actually holds control permissions before issuing bridge-agent tickets — so any user with mere visibility-only access to a shared lease can POST directly to the ticket endpoints and receive credentials that let them impersonate the trusted Code, WebVNC, and Egress bridges. For a CISO, the real risk is what this breaks: teams that grant read-only 'observer' access to a running AI agent session for oversight, compliance review, or incident response are unknowingly handing those observers a path to full control — code execution, remote desktop interaction, and outbound network access — inside that agent's sandbox. Exploitation is close to trivial (CVSS 8.1, AV:N/AC:L/PR:L/UI:N — no more than crafting a few POST requests), though there is no CISA KEV listing, public exploit, or Nuclei template yet, and EPSS sits at just 0.34% (74th percentile), so opportunistic mass exploitation looks unlikely today; the exposure is narrower (4 known downstream dependents) but severe for any org actually using Crabbox to broker agent sandboxes. Patch to Crabbox v0.12.0 immediately (fix in commit 95cb30d / PR #71), and in the interim audit any lease shared with visibility-only collaborators — revoke or rotate those shares and monitor for POST requests to /v1/leases/:id/{code,webvnc,egress}/ticket from principals who shouldn't hold control tickets.

Is CVE-2026-8629 actively exploited?

No confirmed active exploitation of CVE-2026-8629 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-8629?

Upgrade Crabbox to v0.12.0 or later (fix in commit 95cb30dc7dbaa1fef690a42ef6ac1cb6e307a191 / PR #71) immediately. After patching, audit all active lease shares and identify any principals holding visibility-only grants; revoke and reissue lease tickets for those shares as a precaution in case tickets were already obtained pre-patch. If self-hosting or fronting Crabbox with a custom control plane, add defense-in-depth authorization checks that independently verify caller role before proxying ticket requests. For detection, alert on calls to /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket from accounts whose lease role is visibility-only, and review bridge-connection audit logs for Code/WebVNC/Egress sessions not matching the lease owner's identity.

What systems are affected by CVE-2026-8629?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, computer-use / agentic sandbox environments.

What is the CVSS score for CVE-2026-8629?

CVE-2026-8629 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscomputer-use / agentic sandbox environments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.

Exploitation Scenario

An organization shares a lease (an AI agent's sandbox) with a compliance or security reviewer in visibility-only mode so they can observe the agent's behavior without being able to act. That reviewer's account — or an attacker who compromised it — sends direct POST requests to /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket for the target lease ID, bypassing the intended read-only path since the server never checks whether the caller's role permits control actions. The attacker uses the returned Code ticket to execute arbitrary commands inside the sandbox, the WebVNC ticket to interact with the desktop as the trusted bridge would, and the Egress ticket to route traffic through the sandbox's network path — enabling data exfiltration from whatever the agent's sandbox can reach, or using it as a pivot point into connected internal resources.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.