CRITICAL

CVE-2026-90945

2026-09-14 CVSS v3.1

CVSS

9.8

Description

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

Weakness (CWE)

CWE-321

EPSS Score

0.53%

Probability of exploitation in next 30 days

43.6th percentile

References

https://github.com/crawlab-team/crawlab https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go https://github.com/crawlab-team/crawlab/issues/1622 https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE