Executive brief
Crabbox, a tool used for managing cloud resources and microVM leases, contains a security flaw in how it verifies user login tokens. An attacker who already has basic, non-administrative access can create a specially crafted token that falsely claims they have administrator rights. If successful, the attacker can gain full control over the system, allowing them to view all active leases, manage resource pools, and force the release or deletion of resources.
Technical details
An authentication bypass and privilege escalation vulnerability exists in Crabbox's coordinator component due to improper validation of signed user tokens (cbxu_). The verifyUserToken() function in worker/src/auth.ts validates the HMAC signature and expiration but fails to reject or strip 'admin' claims within the payload. In deployments where the signing secret (CRABBOX_SESSION_SECRET) falls back to the publicly known or shared non-admin token (CRABBOX_SHARED_TOKEN), an attacker with low-privileged access can manually sign a token containing 'admin: true'. This allows the attacker to reach admin-only routes, granting full access to lease visibility, pool state management, and forced release operations. The issue is fixed in version 0.9.0 by explicitly rejecting user tokens containing admin claims and ensuring the authenticated context is non-admin by construction.
Affected products
- openclaw Crabbox < 0.9.0
Timeline
- 2026-05-09: patched: Fix merged in pull request #64
- 2026-05-10: advisory: Release v0.9.0 published
- 2026-05-11: disclosed: CVE-2026-45223 published