{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/skypilot-org/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-75481"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["skypilot"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","cloud-security","cve-2026-75481"],"_cs_type":"advisory","_cs_vendors":["skypilot-org"],"content_html":"\u003cp\u003eSkyPilot versions through 0.13.1rc1 are affected by a critical privilege management vulnerability, identified as CVE-2026-75481. The flaw resides in the service account management logic, specifically within the \u003ccode\u003esky/users/server.py\u003c/code\u003e module, where the application fails to perform authorization checks when a user attempts to update the permissions of a service account.\u003c/p\u003e\n\u003cp\u003eAn authenticated attacker can leverage this oversight to create a new service account and subsequently elevate that account's permissions to the administrator level. By obtaining a bearer token for the newly escalated service account, the attacker can impersonate an administrator to gain full control over all user workspaces and platform configurations. Given the potential for complete administrative compromise of the SkyPilot instance, this vulnerability is rated as High severity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target SkyPilot instance as a standard user.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the service account creation API endpoint to provision a new, low-privileged service account.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the API request responsible for updating service account permissions.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted request to the permission update endpoint, targeting the newly created service account.\u003c/li\u003e\n\u003cli\u003eThe application backend fails to validate that the requesting user possesses administrative privileges before processing the role elevation request.\u003c/li\u003e\n\u003cli\u003eAttacker confirms the service account role has been elevated to 'administrator' status.\u003c/li\u003e\n\u003cli\u003eAttacker requests a bearer token associated with the elevated service account.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes the administrator-level bearer token to perform unauthorized administrative actions across all workspaces.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-75481 grants an attacker full administrative control over a SkyPilot environment. This includes the ability to modify, delete, or inspect any user workspace, potentially leading to widespread data exfiltration, service disruption, and unauthorized compute resource consumption. The impact is significant for multi-tenant or team-based environments relying on SkyPilot for workload orchestration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade SkyPilot to version 0.13.2 or later immediately to include the patch for CVE-2026-75481.\u003c/li\u003e\n\u003cli\u003eAudit existing service accounts for unauthorized administrative privileges using current platform logs.\u003c/li\u003e\n\u003cli\u003eRevoke any bearer tokens associated with service accounts created or modified within the last 30 days if unauthorized activity is suspected.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to service account management endpoints originating from non-administrator user accounts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-17T22:51:58Z","date_published":"2026-08-17T22:51:58Z","id":"https://feed.craftedsignal.io/briefs/2026-08-skypilot-priv-esc/","summary":"SkyPilot versions through 0.13.1rc1 are vulnerable to a privilege escalation flaw allowing authenticated users to elevate service account roles to administrator, resulting in full platform takeover.","title":"SkyPilot Privilege Escalation Vulnerability (CVE-2026-75481)","url":"https://feed.craftedsignal.io/briefs/2026-08-skypilot-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Skypilot-Org","version":"https://jsonfeed.org/version/1.1"}