---
id: CVE-2026-8634
title: >-
  Crabbox prior to v0.12.0 contains an environment variable exposure
  vulnerability that allows attackers with access to a malicious or compromised
  repository to forward local secrets such as API tokens, cloud credentials, and
  broker tokens…
summary: >-
  Crabbox prior to v0.12.0 contains an environment variable exposure
  vulnerability that allows attackers with access to a malicious or compromised
  repository to forward local secrets such as API tokens, cloud credentials, and
  broker tokens…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-94
vendor: openclaw
product: crabbox
affected:
  - crabbox < 0.12.0
patched:
  - github.com/openclaw/crabbox 0.12.0
published: '2026-05-14'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:59.307'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8634'
references:
  - url: >-
      https://github.com/openclaw/crabbox/commit/eaae40ae4ce009e60633f16f7f19600c74557f6f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openclaw/crabbox/pull/78'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openclaw/crabbox/releases/tag/v0.12.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/crabbox-environment-variable-information-disclosure
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openclaw/crabbox/pull/78'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8634'
  - url: 'https://github.com/advisories/GHSA-fm77-94qm-4894'
  - url: 'https://github.com/openclaw/crabbox'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-05-15T14:16:23.398053Z'
epss: 0.00955
epssPercentile: 0.61227
aliases:
  - GHSA-fm77-94qm-4894
  - GO-2026-5369
ecosystem: go
ingestedAt: '2026-07-21T19:04:58.879Z'
---

## Overview

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-8634)

Affected packages:

- `github.com/openclaw/crabbox < 0.12.0`

Patched in:

- `github.com/openclaw/crabbox 0.12.0`

Source: https://osv.dev/vulnerability/GHSA-fm77-94qm-4894