CVE-2026-45223 openclaw CVE debrief

Who should care

Users of Crabbox before version 0.9.0 should be aware of this vulnerability and take steps to mitigate it. This vulnerability could allow an attacker with access to the shared non-admin token to gain full coordinator admin access, including lease visibility, pool state management, and forced release operations. Operators, platform administrators, vulnerability management teams, and security teams should review the official CVE record and vendor guidance to determine the affected scope and severity.

Technical summary

The CVE-2026-45223 vulnerability is caused by the verifyUserToken() function failing to properly verify user tokens. Specifically, it does not reject payloads containing an admin claim. An attacker can exploit this by crafting a user-token payload with admin: true, signing it with HMAC-SHA256, and using it to access admin-only coordinator routes. This could lead to unauthorized access to sensitive operations such as lease visibility, pool state management, and forced release operations.

Defensive priority

High

Recommended defensive actions

• Upgrade Crabbox to version 0.9.0 or later
• Restrict access to admin-only coordinator routes
• Monitor for suspicious activity related to user token verification
• Implement additional security measures to prevent privilege escalation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-11T19:16:28.103Z and was last modified on 2026-07-14T21:16:54.963Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability from the source item. Defenders should verify the affected scope and severity with the official CVE record and vendor guidance. The Crabbox coordinator user-token verification path vulnerability allows attackers to escalate privileges by crafting a user-token payload with admin: true, signing it using HMAC-SHA256, and presenting it to admin-only coordinator routes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.