---
id: CVE-2026-90945
title: >-
  Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token
  signing that cannot be overridden via configuration or environment variables
summary: >-
  Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token
  signing that cannot be overridden via configuration or environment variables.
  Unauthenticated attackers can forge valid administrator tokens to access
  administrativ…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-321
vendor: crawlab-team
product: crawlab
affected:
  - crawlab <= 0.6.3
published: '2026-09-14'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:44.690'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90945'
references:
  - url: 'https://github.com/crawlab-team/crawlab'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crawlab-team/crawlab/issues/1622'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crawlab-team/crawlab/issues/1622'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00765
epssPercentile: 0.53633
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-16T16:04:22.469556Z'
ingestedAt: '2026-09-14T19:13:23.463Z'
---

## Overview

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.