CyberRota Analysis
AI-GeneratedSkyPilot is vulnerable due to inadequate validation of user permissions, allowing authenticated users to improperly grant themselves administrator roles when updating service account permissions. This flaw enables attackers to create a service account, escalate its privileges, and gain administrative control over all users and workspaces using the associated bearer token. Organizations utilizing SkyPilot should prioritize addressing this vulnerability to prevent potential unauthorized access and control over their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.