CVE-2026-45223: Crabbox Auth Bypass Vulnerability

CVE-2026-45223 Overview

CVE-2026-45223 is an authentication bypass vulnerability in Crabbox versions before 0.9.0. The flaw resides in the coordinator user-token verification path, where the verifyUserToken() function fails to reject payloads containing an admin claim. An attacker who possesses a shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes. Successful exploitation grants full coordinator admin access, including lease visibility, pool state management, and forced release operations. The weakness is classified under [CWE-290: Authentication Bypass by Spoofing].

Critical Impact
Attackers with access to a shared non-admin token can escalate to full coordinator admin privileges by injecting an admin: true claim into a signed user token.

Affected Products

Crabbox versions prior to 0.9.0
Crabbox coordinator component (worker/src/auth.ts)
Crabbox deployments relying on shared non-admin tokens

Discovery Timeline

2026-05-11 - CVE-2026-45223 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-45223

Vulnerability Analysis

The vulnerability exists in the Crabbox coordinator's token verification routine. The verifyUserToken() function validates the HMAC-SHA256 signature of incoming user tokens but does not strip or reject an admin claim embedded in the payload. Because the signing key is shared across non-admin users, any holder of that key can mint tokens with arbitrary claim values, including elevated admin: true.

Once accepted, the forged token grants access to admin-only coordinator routes. These routes expose lease visibility, pool state management, and forced release operations. An attacker with coordinator admin access can disrupt workload scheduling, observe sensitive lease metadata, and forcibly release resources held by other tenants.

Root Cause

The root cause is missing claim validation in the user-token verification path. The token schema permitted an optional admin?: boolean field that the verification logic treated as authoritative. Because the same HMAC-SHA256 key was used for both non-admin and admin token issuance, signature validity alone could not distinguish privilege levels. The fix removes the admin field from the user-token type, ensuring the coordinator cannot honor admin claims that originate from user-scoped tokens.

Attack Vector

Exploitation requires network access to a Crabbox coordinator endpoint and possession of a valid shared non-admin token (or its signing key). The attacker constructs a JSON payload mirroring a legitimate user token, adds admin: true, signs the payload with HMAC-SHA256 using the shared secret, and submits it to an admin-only coordinator route. The coordinator validates the signature, observes the admin claim, and authorizes the request.

typescript

// Patch from worker/src/auth.ts removing the admin field from user-token schema
   org: string;
   login: string;
   name?: string;
-  admin?: boolean;
   exp: number;
   iat: number;
 }

Source: GitHub Commit 46079f6

Detection Methods for CVE-2026-45223

Indicators of Compromise

Coordinator audit log entries showing admin-only route access (lease enumeration, pool state changes, forced release) initiated by user accounts not provisioned as administrators.
Authenticated requests whose decoded JWT-style payloads contain admin: true originating from non-admin subjects or login values.
Unexpected forced release operations or pool state mutations correlated with non-admin token identifiers.

Detection Strategies

Parse coordinator request logs and flag any verified user token whose payload contains an admin claim prior to upgrading to 0.9.0.
Compare the login or org claim against the directory of provisioned admins; alert when admin routes are reached by a non-admin principal.
Monitor for anomalous spikes in lease-listing and forced-release API calls from a single token subject.

Monitoring Recommendations

Enable verbose authentication logging on the Crabbox coordinator and forward to a centralized analytics platform for correlation.
Track token issuance and rotation events; investigate any reuse of pre-0.9.0 signing keys after upgrade.
Build dashboards for admin-route access frequency and baseline expected admin activity to surface deviations.

How to Mitigate CVE-2026-45223

Immediate Actions Required

Upgrade all Crabbox deployments to version 0.9.0 or later, which removes the admin field from the user-token schema.
Rotate the HMAC-SHA256 signing secret used by the coordinator to invalidate any previously issued tokens that may carry forged admin claims.
Audit recent coordinator activity for admin-only route access by non-admin principals and revoke compromised tokens.

Patch Information

The fix is delivered in Crabbox v0.9.0 via Pull Request #64 and merged in commit 46079f6. The patch removes the admin?: boolean field from the user-token type so the coordinator can no longer honor admin claims embedded in user tokens. Release notes are available at the Crabbox v0.9.0 release page. Additional analysis is published in the VulnCheck advisory.

Workarounds

Restrict network access to admin-only coordinator routes using firewall rules or service mesh policies until the upgrade is applied.
Segregate admin and non-admin token issuance by using distinct signing keys, so a non-admin secret cannot mint admin-valid signatures.
Add a reverse-proxy filter that strips or rejects requests whose token payloads contain an admin claim from non-admin subjects.

bash

# Example: upgrade Crabbox to the patched release
git fetch --tags
git checkout v0.9.0
# Rotate the coordinator HMAC-SHA256 signing secret after upgrade
export CRABBOX_COORDINATOR_SECRET="$(openssl rand -hex 32)"
# Restart the coordinator service to load the new secret
systemctl restart crabbox-coordinator