CVE-2026-90945
CriticalCVSS 9.8Summary
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
Risk Assessment
Because the secret is publicly known and immutable, anyone can impersonate an administrator and take control of the cluster and worker nodes.
Recommendation
Update Crawlab to a version where the JWT secret is configurable, and immediately rotate the signing key and invalidate existing tokens.
Other vulnerabilities in Crawlab
Original NVD description (English source)
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.