CVE-2026-13482— skypilot-org skypilot User ID server.py username.encode weak hash
Possible ATT&CK Techniques 1AI
T1621 · Multi-Factor Authentication Request GenerationAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| skypilot-org | skypilot | 0.1 | affected |
0.2 | affected | ||
0.3 | affected | ||
0.4 | affected | ||
0.5 | affected | ||
0.6 | affected | ||
0.7 | affected | ||
0.8 | affected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13482
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
skypilot-org skypilot User ID server.py username.encode weak hash
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component User ID Handler. The manipulation results in use of weak hash. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可逆的单向哈希
Source: CVE Program / CVE List V5
Vulnerability Title
skypilot-org SkyPilot 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
skypilot-org SkyPilot是skypilot-org组织开源的一个可以在任何 AI 基础设施上运行、管理和扩展 AI 工作负载的系统。 skypilot-org skypilot 0.12.0及之前版本存在加密问题漏洞，该漏洞源于User ID Handler组件的sky/users/server.py文件中的username.encode函数使用了弱哈希。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| skypilot-org | skypilot | 0.1 | cpe:2.3:a:skypilot-org:skypilot:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-13482
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13482
请登录查看更多情报信息。
Vendor Pages for CVE-2026-13482 (1)
Other References for CVE-2026-13482 (1)
IV. Related Vulnerabilities
Same weakness: CWE-328
- CVE-2026-15605
wandb Artifact Integrity Validation hashutil.py ArtifactMani - CVE-2026-41879
Weak password hashing in R-SOFT DMS - CVE-2026-14742
langchain-ai langgraph Task Result Cache _cache.py _freeze w - CVE-2026-14738
exo-explore exo Vision Feature Cache vision.py _image_cache_ - CVE-2026-14630
ForceInjection AI-fundermentals Memory Recall smart_customer
V. Comments for CVE-2026-13482
No comments yet