CRITICAL 9.3 NVD
CVE-2026-90945
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthent
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
References
- https://github.com/crawlab-team/crawlab
- https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go
- https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core
- https://github.com/crawlab-team/crawlab/issues/1622
- https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-14 via NVD.
Risk Timeline
CVE Disclosed2026-09-14 · 0 days ago
Remediation Resources
vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.