CVE-2026-75481

Received Received - Intake

SkyPilot Privilege Escalation via Unauthorized Role Assignment

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75481

EUVD

EUVD-2026-60393

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

SkyPilot does not verify if authenticated users have permission to grant admin roles when updating service account permissions. Attackers can create a service account, escalate it to admin, and use its token to gain full administrative control over all users and workspaces.

Impact Analysis

An attacker could gain full administrative access to your SkyPilot environment, allowing them to control all users, workspaces, and sensitive data. This could lead to data breaches, unauthorized access, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, loss of compliance certifications, and reputational damage.

Mitigation Strategies

Review and restrict service account permissions to prevent unauthorized role escalation. Audit existing service accounts and remove any with administrator privileges that were not explicitly granted. Monitor for unusual service account creation or permission changes.

Hi! I’m here to help you understand CVE-2026-75481. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70