---
id: CVE-2026-56265
aliases:
  - GHSA-8qrg-7j2f-rf2h
title: >-
  Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT
  signing key in the Docker API server
summary: >-
  Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT
  signing key in the Docker API server
severity: critical
cvss: 9.8
cwe:
  - CWE-798
vendor: crawl4ai
product: crawl4ai
ecosystem: pip
affected:
  - crawl4ai < 0.8.7
patched:
  - crawl4ai 0.8.7
published: '2026-06-21'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T17:19:37Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8qrg-7j2f-rf2h'
references:
  - url: >-
      https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56265'
  - url: >-
      https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key
  - url: 'https://github.com/unclecode/crawl4ai/releases/tag/v0.8.7'
  - url: 'https://github.com/advisories/GHSA-8qrg-7j2f-rf2h'
tags:
  - ghsa
  - pip
  - exploit-available
epss: 0.02639
epssPercentile: 0.84923
exploits:
  nuclei:
    - CVE-2026-56265
  checkedAt: '2026-09-25T08:21:03.771Z'
exploitAvailable: true
ingestedAt: '2026-09-14T18:12:17.166Z'
---

## Overview

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

## Affected packages

- `crawl4ai < 0.8.7`

## Remediation

Upgrade to a patched release:

- `crawl4ai 0.8.7`