CVE-2026-13482

Name of the Vulnerable Software and Affected Versions skypilot versions prior to 0.12.1

Description The User ID Handler component contains a flaw where the username.encode() function in the sky/users/server.py file utilizes a weak hash. This issue allows a remote attacker to perform a high-complexity attack, although exploitability is considered difficult.

Recommendations Update to a version newer than 0.12.0. As a temporary mitigation, restrict access to the username.encode() function within the User ID Handler.