Authentication Bypass Vulnerability in Crawlab by Crawlab Team
CVE-2026-90945

9.3CRITICAL

Key Information:

Vendor

Crawlab-team

Status
Crawlab
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90945?

Crawlab versions up to 0.6.3 are vulnerable due to the use of a hard-coded HMAC-SHA256 secret for JWT token signing. This design flaw prevents the secret from being overridden via configuration or environmental variables, allowing unauthenticated attackers to forge valid administrator tokens. This unauthorized access can lead to exploitation of administrative APIs and potential code execution on worker nodes. Users of affected versions are strongly urged to assess their security posture and implement necessary mitigations.

Affected Version(s)

crawlab 0 <= 0.6.3

References

https://github.com/crawlab-team/crawlab/issues/1622
issue-tracking
https://github.com/crawlab-team/crawlab
product
https://github.com/crawlab-team/crawlab/blob/0485310def8b...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.