A hard-coded HMAC-SHA256 signing secret in Crawlab through version 0.6.3 lets unauthenticated attackers forge administrator tokens and execute code on worker nodes, earning a CVSS 3.1 score of 9.8 (Critical).
What Is It
Crawlab, an open-source web crawler management platform from crawlab-team, signs its JWT session tokens with a hard-coded HMAC-SHA256 secret. According to the disclosure, the secret cannot be overridden through configuration files or environment variables, which would mean that deployments running an affected version share the same signing key. The flaw is tracked as CWE-321 (Use of Hard-coded Cryptographic Key) and was disclosed by VulnCheck.
Why It Matters
Because the signing key is fixed and publicly known, an attacker should be able to mint a valid administrator token offline; no credentials, no user interaction, no prior access. That token unlocks Crawlab's administrative APIs, which in turn provide a path to code execution on worker nodes.
The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores the maximum exploitability subscore of 3.9: network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. The CVSS 4.0 assessment rates it 9.3 (Critical) with the same unauthenticated network profile. Given that profile, defenders would be prudent to treat an internet-exposed Crawlab instance as a likely target and assume it is reachable by anyone who has read the advisory.
What's Vulnerable
- Vendor/Product: crawlab-team / Crawlab
- Affected versions: all versions through 0.6.3 (
<= 0.6.3) - Repository: https://github.com/crawlab-team/crawlab
No CPE configurations are published in the NVD record at this time. The disclosure points to the user service implementations in core/user/service_v2.go and crawlab-core/user/service.go as the relevant code.
Patch Status
The NVD record is in Received status (published 2026-09-14) and names no fixed version; the affected range covers everything up to and including 0.6.3, with no release identified as remediated. As of publication there is no CISA KEV entry for this CVE, which means no exploitation has been confirmed and catalogued by CISA and no federally mandated remediation deadline applies; absence from KEV is not itself evidence that exploitation is not occurring. Track upstream issue #1622 and the VulnCheck advisory for fix availability. Until a patched release ships, the most reliable mitigation supported by the source material appears to be preventing untrusted network access to Crawlab instances, since the secret is not changeable by configuration.
Sources
- NVD, CVE-2026-90945: https://nvd.nist.gov/vuln/detail/CVE-2026-90945
- VulnCheck Advisory; Crawlab through 0.6.3 Authentication Bypass via Hard-Coded JWT Secret: https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret
- Crawlab GitHub Repository: https://github.com/crawlab-team/crawlab
- Crawlab Issue #1622: https://github.com/crawlab-team/crawlab/issues/1622
- Affected code; core/user/service_v2.go: https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go
- Affected code; crawlab-core/user/service.go: https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go