CVE-2026-75481 | BDVDB-2026-360737 Detail
skypilot-orgskypilot
Description#
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-269 Improper Privilege Management
References#
- https://github.com/skypilot-org/skypilot/issues/9846
- https://github.com/skypilot-org/skypilot
- https://github.com/skypilot-org/skypilot/commit/8a3e00259cd374e662cd876c037164bcb070f78e
- https://github.com/skypilot-org/skypilot/blob/master/sky/users/server.py
- https://www.vulncheck.com/advisories/skypilot-authentication-bypass-via-service-account-role-escalation
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.