CVE-2026-8634 - Vulnerability Analysis

Overview

Crabbox < 0.12.0 contains an environment variable exposure vulnerability caused by overly permissive environment variable allowlisting in repo-local configuration, letting attackers with repository access expose local secrets in remote command environment, exploit requires attacker to have access to a malicious or compromised repository.

Severity & Score

Impact

Attackers with repository access can expose sensitive environment variables, leading to credential leakage and potential further compromise.

Mitigation

Update to version 0.12.0 or later.

References

• https://github.com/openclaw/crabbox/pull/78
• https://github.com/openclaw/crabbox/releases/tag/v0.12.0
• https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure
• https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner