CVE-2026-90945: Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crawlabto a version that resolves this vulnerability.Fixed in 0.6.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of Crawlab through 0.6.3 is exposed because the JWT signing secret is hard-coded and cannot be changed through configuration or environment variables. An attacker can target administrative APIs without authenticating first.
What does an attacker need to exploit it?
The attacker needs network access to the affected Crawlab instance's administrative API. No valid account, privileges, or user interaction are required.
What can an attacker do after exploiting the issue?
An attacker can forge a valid administrator JWT and use administrative API access to execute code on worker nodes.