Vulnerability · Published May 14, 2026 · Assigned by VulnCheck
CVE-2026-8634Crabbox < v0.12.0 Environment Variable Information Disclosure
Critical 9.1
In plain English
A critical-severity code injection in crabbox from openclaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/openclaw/crabbox | 0.12.0 | GHSA-fm77-94qm-4894 |
| Go | github.com/openclaw/crabbox | 0.12.0 | GO-2026-5369 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/openclaw/crabbox/releases/tag/v0.12.0 release-notes
- https://github.com/openclaw/crabbox/pull/78 issue-tracking
- https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f patch
- https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure third-party-advisory