Hard-coded JWT Secret in Crawlab Allows Admin Access

Executive Summary

CVE-2026-90945 is a vulnerability in Crawlab versions up to 0.6.3 where a hard-coded HMAC-SHA256 secret is used for JWT token signing. This secret cannot be changed via configuration or environment variables, allowing unauthenticated attackers to forge valid administrator tokens.

Useful 0 Not Useful 0

Detection Guidance

Check if Crawlab is running by inspecting network services or processes. Look for hardcoded JWT secret 'crawlab' in configuration files or environment variables. Inspect JWT tokens for default signatures using tools like jwt_tool or manual HMAC-SHA256 verification with the known secret.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can forge administrator tokens to access administrative APIs and execute arbitrary code on worker nodes. This could lead to full system compromise, unauthorized data access, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient access controls and potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Crawlab to a version that allows overriding the HMAC-SHA256 secret via configuration or environment variables. If no such version exists, consider replacing Crawlab with an alternative solution that does not use hard-coded secrets.

Useful 0 Not Useful 0