Description
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
skypilot-org skypilot
Default version status: unaffected
0 to ≤ 0.13.1rc1affected
pkg:pypi/skypilotReferences
- https://github.com/skypilot-org/skypilot/issues/9846 ↗
- https://github.com/skypilot-org/skypilot ↗
- https://github.com/skypilot-org/skypilot/commit/8a3e00259cd374e662cd876c037164bcb070f78e ↗
- https://github.com/skypilot-org/skypilot/blob/master/sky/users/server.py ↗
- https://www.vulncheck.com/advisories/skypilot-authentication-bypass-via-service-account-role-escalation ↗