What’s Vulnerable › Vulnerabilities

CVE-2026-90945: Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-321

Description

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

Affected products

• crawlab-team crawlab: through 0.6.3

References

• https://github.com/crawlab-team/crawlab
• https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go
• https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go
• https://github.com/crawlab-team/crawlab/issues/1622
• https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret
• https://github.com/crawlab-team/crawlab/issues/1622

Get alerted when CVE-2026-90945 or the next vulnerability affects your stack