PT-2026-39729 · Crabbox · Crabbox

Hinotoi-Agent · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-45223

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crabbox versions prior to 0.9.0

Description An authentication bypass exists in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, which allows attackers to escalate privileges. An attacker with access to a shared non-admin token can craft a user-token payload with the admin variable set to true, sign it using HMAC-SHA256 (a cryptographic hash function used for verifying data integrity), and access admin-only coordinator routes. This provides full coordinator admin access, including lease visibility, pool state management, and forced release operations.

Recommendations Update to version 0.9.0 or later.

Exploit

Fix

LPE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-45223

Affected Products

Crabbox

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45223.json · Exploit
• 🔥 https://github.com/openclaw/crabbox/pull/64 · Exploit
• https://github.com/openclaw/crabbox/commit/46079f6de7f10cf61bc47efebd0c143a41664898 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45223 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45223 · Vendor Advisory
• https://github.com/openclaw/crabbox · Note
• https://github.com/openclaw/crabbox/releases/tag/v0.9.0 · Note
• https://vulncheck.com/advisories/crabbox-authentication-bypass-via-admin-claim-injection · Note
• https://twitter.com/CVEnew/status/2053932387332231523 · Twitter Post
• https://twitter.com/0x2ed3bb60/status/2053919327775289737 · Twitter Post