CVE-2026-8634
Last modified
CVE-2026-8634 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-8634?
How severe is CVE-2026-8634?
How do I fix CVE-2026-8634?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8627The Correct Prices plugin for WordPress is vulnerable to Ref…6.1
- CVE-2026-8628The EntreDroppers plugin for WordPress is vulnerable to Refl…6.1
- CVE-2026-8629Crabbox prior to v0.12.0 contains a privilege escalation vul…8.6
- CVE-2026-8631A potential security vulnerability has been identified in th…9.8
- CVE-2026-8632A potential security vulnerability has been identified in th…7.8
- CVE-2026-8633IBM Web Server Plug-ins for WebSphere Application Server and…9.8
- CVE-2026-8635IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated u…9.9
- CVE-2026-8636IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…7.5
- CVE-2026-8637A potential uncontrolled search path vulnerability was repor…8.5
- CVE-2026-8643pip would treat console_scripts and gui_scripts as paths ins…5.5
- CVE-2026-8644IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9.1
- CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
Are you affected by CVE-2026-8634?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST