CVE-2026-90945criticalCWE-321

CVE-2026-90945: critical vulnerability in crawlab-team crawlab

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Published · Updated

Follow this CVE+ Monitor crawlab

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.8%
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
crawlab-team · crawlab
Related CVEs — crawlab-team crawlab

In the same product, most dangerous first.

CVE-2026-75103HIGHCrawlab Missing Authorization on Password Change Endpoint Allows Account TakeoverEPSS 0.6%