CVE-2026-75481
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
269
Improper Privilege Management
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
https://github.com/skypilot-org/skypilot/issues/9846
https://github.com/skypilot-org/skypilot
https://github.com/skypilot-org/skypilot/blob/master/sky/users/server.py
https://github.com/skypilot-org/skypilot/commit/8a3e00259cd374e662cd876c037164b…
https://github.com/skypilot-org/skypilot/issues/9846
https://www.vulncheck.com/advisories/skypilot-authentication-bypass-via-service…