What’s Vulnerable › Vulnerabilities

CVE-2026-8634: Crabbox < v0.12.0 Environment Variable Information Disclosure

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-14 · updated 2026-10-26
• Weakness: CWE-94

Description

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

Affected products

• openclaw crabbox: before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: openclaw crabbox 0.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f
• https://github.com/openclaw/crabbox/pull/78
• https://github.com/openclaw/crabbox/releases/tag/v0.12.0
• https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure
• https://github.com/openclaw/crabbox/pull/78

Get alerted when CVE-2026-8634 or the next vulnerability affects your stack