Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-75481SkyPilot Authentication Bypass via Service Account Role Escalation
High 8.8
In plain English
A high-severity privilege mismanagement in skypilot from skypilot-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 70.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| skypilot-org | skypilot | 0 – through 0.13.1rc1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #9846 issue-tracking
- https://github.com/skypilot-org/skypilot product
- [API] Validate the role a service account may be granted (#10482) patch
- update_service_account_role in sky/users/server.py technical-description
- VulnCheck Advisory: SkyPilot Authentication Bypass via Service Account Role Escalation third-party-advisory