CVE-2026-8634: Crabbox: environment variable exposure vulnerability
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment.
Published May 14, 2026 · Updated Jul 21, 2026
Affected packages
github.com/openclaw/crabbox
- Ecosystem
- Go
- Affected
- < 0.12.0
- Fixed in
- 0.12.0
- Check
go list -m github.com/openclaw/crabbox
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-8634
- https://github.com/openclaw/crabbox/pull/78
- https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f
- https://github.com/openclaw/crabbox/releases/tag/v0.12.0
- https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure
- https://github.com/advisories/GHSA-fm77-94qm-4894
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology