CVE-2026-75481CWE-269privilege-escalation

CVE-2026-75481

High · published August 18, 2026

CVSS v3.1

8.8

EPSS

Percentile

28.6

In the wild

Unconfirmed

What it is

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00360 · 28.6th percentile
Weakness: CWE-269 · Improper Privilege Management
Published: 2026-08-18T01:16Z

References (6)

https://github.com/skypilot-org/skypilot · [email protected]https://github.com/skypilot-org/skypilot/blob/master/sky/users/server.py · [email protected]https://github.com/skypilot-org/skypilot/commit/8a3e00259cd374e662cd876c037164bcb070f78e · [email protected]https://github.com/skypilot-org/skypilot/issues/9846 · [email protected]https://www.vulncheck.com/advisories/skypilot-authentication-bypass-via-service-account-role-escalation · [email protected]https://github.com/skypilot-org/skypilot/issues/9846 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:36Z
SkyPilot Authentication Bypass via Service Account Role Escalation
cvelistv5