CVE-2026-56265criticalCWE-798

CVE-2026-56265: fallo crítico en Crawl4AI

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Crawl4AI+ Monitorear crawl4ai

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 9.3epss 2.6%
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Crawl4AI · Crawl4AI
CVEs relacionadas — Crawl4AI

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-56258CRITICALCrawl4AI - Arbitrary File Write via output_path Symlink and TOCTOUEPSS 0.9%CVE-2026-56262MEDIUMCrawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API ServerEPSS 0.8%CVE-2026-56260HIGHCrawl4AI - Arbitrary File Write via output_path ParameterEPSS 0.6%CVE-2026-56261CRITICALCrawl4AI - Server-Side Request Forgery via Webhook URLsEPSS 0.5%CVE-2026-56264CRITICALCrawl4AI - Arbitrary JavaScript Execution via /execute_js EndpointEPSS 0.5%CVE-2026-56266CRITICALCrawl4AI - Server-Side Request Forgery via Direct Crawl EndpointsEPSS 0.5%