CVE-2026-8634 Crabbox < v0.12.0 Environment Variable Information Disclosure
Attackers with access to a malicious repository can leak local secrets like API tokens to remote environments via overly permissive environment variable allowlisting in Crabbox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8634?
CVE-2026-8634 is a critical vulnerability in openclaw crabbox, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
Weakness: CWE-94
Which versions are affected by CVE-2026-8634?
3 open source packages ship an affected version, including github.com/openclaw/crabbox.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openclaw/crabbox Go | All versions | 0.12.0 |
github.com/openclaw/crabbox Go | All versions | 0.12.0 |
github.com/openclaw/crabbox Go | All versions | 0.12.0 |
How do I fix CVE-2026-8634?
Upgrade github.com/openclaw/crabbox to 0.12.0 or later.
Is CVE-2026-8634 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8634 exists.
Sources
Also known as GHSA-fm77-94qm-4894, GO-2026-5369.