CVE-2026-90945

EUVD-2026-77712
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/crawlab-team/crawlab
https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go
https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go
https://github.com/crawlab-team/crawlab/issues/1622
https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret