CVE-2026-8634: OpenClaw env-var allowlist leaks

CISO Take

Crabbox prior to v0.12.0 lets a malicious or compromised repository define a repo-local allowlist of environment variables that Crabbox then serializes into the remote command execution environment — meaning API tokens, cloud credentials, and broker tokens sitting in a developer's or CI runner's local environment can be silently forwarded to an attacker-controlled remote process (CWE-94, CVSS 9.1 critical, network-exploitable with no privileges or user interaction beyond running the tool against the malicious repo). The real-world urgency is tempered: EPSS sits at 0.00742 (top 50%, not top-tier), there's no public exploit or Nuclei template, it's not in CISA KEV, and only 4 known downstream dependents limit blast radius — but any AI agent pipeline that clones untrusted repos and executes Crabbox-driven remote commands against them (a common pattern for agentic CI/build tooling) is directly exposed to credential theft and onward pivoting. Upgrade to Crabbox v0.12.0 or later immediately, since the fix (commit eaae40a, PR #78) tightens the environment variable allowlisting logic. Until patched, treat any repo-local Crabbox configuration from an untrusted source as hostile: audit `.crabbox` config allowlists before running the tool, strip or rotate any credentials exposed to remote execution contexts, and monitor for unexpected outbound use of API tokens/cloud credentials/broker tokens shortly after running Crabbox against third-party repositories.

Sources: NVD EPSS ATLAS github.com vulncheck.com

What is the risk?

CVSS 9.1 (network, low complexity, no privileges, no user interaction) reflects a genuinely severe confidentiality and integrity impact — leaked secrets in a remote execution context can enable full downstream compromise of cloud accounts, message brokers, or other APIs. However, real-world exploitability signals are modest: EPSS is only 0.00742 (top 50th percentile, not a high-probability target), there is no CISA KEV listing, no public exploit code, and no scanner template. The attack also requires the victim to run Crabbox against a repository the attacker controls or has compromised — a supply-chain precondition, not a pure remote-network exploit. Net risk: high severity if triggered, but currently low observed exploitation pressure and a narrow blast radius (4 downstream dependents).

How does the attack unfold?

Malicious repo delivery

Attacker publishes or compromises a repository containing a Crabbox configuration with an overly permissive environment variable allowlist.

AML.T0010

Repo-local config trust

Victim clones or invokes Crabbox against the repository, which implicitly trusts the repo-local allowlist configuration.

AML.T0081

Secret serialization

Crabbox forwards the allowlisted local environment variables — API tokens, cloud credentials, broker tokens — into the remote command execution environment.

AML.T0083

Credential compromise and pivot

Attacker captures the exposed secrets from the remote environment and uses them to access the victim's cloud, API, or messaging infrastructure.

AML.T0025

Malicious repo delivery

Attacker publishes or compromises a repository containing a Crabbox configuration with an overly permissive environment variable allowlist.

AML.T0010

Repo-local config trust

Victim clones or invokes Crabbox against the repository, which implicitly trusts the repo-local allowlist configuration.

AML.T0081

Secret serialization

Crabbox forwards the allowlisted local environment variables — API tokens, cloud credentials, broker tokens — into the remote command execution environment.

AML.T0083

Credential compromise and pivot

Attacker captures the exposed secrets from the remote environment and uses them to access the victim's cloud, API, or messaging infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade to Crabbox v0.12.0 or later immediately (fix in commit eaae40a / PR #78). 2) Until upgraded, do not run Crabbox against untrusted, public, or third-party repositories without manually inspecting the repo-local Crabbox configuration for environment variable allowlist entries. 3) Apply least-privilege to any environment where Crabbox runs — avoid storing long-lived cloud credentials, broker tokens, or API keys in environments that invoke Crabbox against externally-sourced repos. 4) Rotate any credentials that were present in environments where Crabbox processed untrusted repositories prior to patching. 5) Detection: monitor for anomalous outbound API calls or cloud/broker authentication events correlated with Crabbox execution against newly-added or low-trust repositories; audit CI logs for unexpected environment variable exposure in remote command payloads.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Data Leakage Agent Framework AML.T0010 - AI Supply Chain Compromise AML.T0010.005 - AI Agent Tool AML.T0055 - Unsecured Credentials AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 6.1 - Policies and procedures for third-party AI system risks

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-8634?

Crabbox prior to v0.12.0 lets a malicious or compromised repository define a repo-local allowlist of environment variables that Crabbox then serializes into the remote command execution environment — meaning API tokens, cloud credentials, and broker tokens sitting in a developer's or CI runner's local environment can be silently forwarded to an attacker-controlled remote process (CWE-94, CVSS 9.1 critical, network-exploitable with no privileges or user interaction beyond running the tool against the malicious repo). The real-world urgency is tempered: EPSS sits at 0.00742 (top 50%, not top-tier), there's no public exploit or Nuclei template, it's not in CISA KEV, and only 4 known downstream dependents limit blast radius — but any AI agent pipeline that clones untrusted repos and executes Crabbox-driven remote commands against them (a common pattern for agentic CI/build tooling) is directly exposed to credential theft and onward pivoting. Upgrade to Crabbox v0.12.0 or later immediately, since the fix (commit eaae40a, PR #78) tightens the environment variable allowlisting logic. Until patched, treat any repo-local Crabbox configuration from an untrusted source as hostile: audit `.crabbox` config allowlists before running the tool, strip or rotate any credentials exposed to remote execution contexts, and monitor for unexpected outbound use of API tokens/cloud credentials/broker tokens shortly after running Crabbox against third-party repositories.

Is CVE-2026-8634 actively exploited?

No confirmed active exploitation of CVE-2026-8634 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-8634?

1) Upgrade to Crabbox v0.12.0 or later immediately (fix in commit eaae40a / PR #78). 2) Until upgraded, do not run Crabbox against untrusted, public, or third-party repositories without manually inspecting the repo-local Crabbox configuration for environment variable allowlist entries. 3) Apply least-privilege to any environment where Crabbox runs — avoid storing long-lived cloud credentials, broker tokens, or API keys in environments that invoke Crabbox against externally-sourced repos. 4) Rotate any credentials that were present in environments where Crabbox processed untrusted repositories prior to patching. 5) Detection: monitor for anomalous outbound API calls or cloud/broker authentication events correlated with Crabbox execution against newly-added or low-trust repositories; audit CI logs for unexpected environment variable exposure in remote command payloads.

What systems are affected by CVE-2026-8634?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD agent pipelines, remote command execution tooling.

What is the CVSS score for CVE-2026-8634?

CVE-2026-8634 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.74%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD agent pipelinesremote command execution tooling

MITRE ATLAS Techniques

AML.T0010 AI Supply Chain Compromise

AML.T0010.005 AI Agent Tool

AML.T0055 Unsecured Credentials

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

Exploitation Scenario

An attacker publishes a seemingly legitimate open-source utility or contributes a pull request to a public repository, embedding a repo-local Crabbox configuration that broadly allowlists sensitive environment variable name patterns (e.g. `*_API_KEY`, `AWS_*`, `BROKER_*`). A victim developer or CI/agent pipeline clones the repository and invokes Crabbox to run a routine remote build or agent task. Crabbox honors the repo's overly permissive allowlist and serializes the victim's local secrets into the remote command execution environment, which is either directly observable by the attacker (if the remote environment is attacker-controlled infrastructure) or logged/exfiltrated via a secondary channel embedded in the same malicious repo. The attacker then uses the harvested API tokens and cloud credentials to pivot into the victim's cloud accounts, LLM API usage, or message broker infrastructure.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.