CVE-2026-55824: Contao CMS Credential Leak Vulnerability

CVE-2026-55824 Overview

CVE-2026-55824 is an information disclosure vulnerability in Contao, an open source content management system. The flaw affects the Contao crawler component, which fails to properly strip authentication credentials before contacting external hosts. When administrators configure contao.crawl.default_http_client_options with Basic or Bearer authentication for protected staging or production sites, those credentials leak to third-party domains during crawling operations. The vulnerability affects versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6. Contao released fixes in versions 5.3.47 and 5.7.7. This issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Attackers who can get an external URL crawled — for example, by placing a link on a crawled page while the broken-link checker is enabled — can capture Basic or Bearer authentication credentials configured for the Contao crawler.

Affected Products

Contao CMS versions 4.13.40 through 5.3.46
Contao CMS versions 5.7.0-RC1 through 5.7.6
Deployments using contao.crawl.default_http_client_options with Basic or Bearer authentication

Discovery Timeline

2026-07-31 - CVE-2026-55824 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-55824

Vulnerability Analysis

Contao's crawler creates two scoped HTTP clients to separate trusted and untrusted requests. Root page origins receive the full HTTP client options, including any configured authentication. External domains receive a cleaned set of options intended to strip sensitive headers and credentials.

The cleaning routine removes the Cookie and Authorization headers correctly. However, it attempts to remove credentials using the option names basic_auth and bearer_auth. Symfony HttpClient does not use these names. The correct option keys are auth_basic and auth_bearer. As a result, Basic and Bearer credentials survive the cleaning step and are attached to outbound requests toward external hosts.

Root Cause

The root cause is an incorrect option-name mapping in the crawler's client sanitization logic. The cleaner references non-Symfony option identifiers, so the sanitization path silently fails to remove the credential fields. Requests dispatched through the "clean" client for external links or additional configured URIs still carry the operator's Basic or Bearer secrets.

Attack Vector

An attacker who controls or influences a URL that Contao's crawler visits can receive the leaked credentials in the inbound HTTP request. The broken-link checker feature amplifies exposure because it follows outbound links from crawled pages to third-party hosts. Exploitation requires the attacker to induce the crawler to fetch an attacker-controlled URL and for the site operator to have configured crawler authentication.

The vulnerability requires low privileges and user interaction. Real-world attacks rely on posting or injecting a link into content that the crawler subsequently visits. See the Contao GitHub Security Advisory GHSA-3mr9-p497-58f6 for technical details.

Detection Methods for CVE-2026-55824

Indicators of Compromise

Outbound crawler requests to unexpected external domains containing Authorization: Basic or Authorization: Bearer headers
Web server or proxy logs showing the Contao crawler user agent contacting third-party hosts with credentials attached
Broken-link checker activity following links to attacker-controlled domains

Detection Strategies

Review egress traffic from Contao hosts for HTTP requests to non-root-page domains that include authentication headers
Audit contao.crawl.default_http_client_options configuration for the presence of auth_basic or auth_bearer values
Correlate crawler request logs with links posted or edited by low-privileged users on crawled pages

Monitoring Recommendations

Enable outbound TLS inspection or forward proxy logging for Contao application servers to detect credential-bearing requests to external domains
Rotate any Basic or Bearer credentials that were configured for the crawler while running an affected version
Alert on authentication failures at upstream services that could indicate credential replay by third parties

How to Mitigate CVE-2026-55824

Immediate Actions Required

Upgrade to Contao 5.3.47 or 5.7.7 as soon as possible
Rotate all Basic and Bearer credentials that were configured under contao.crawl.default_http_client_options on affected installations
Disable the broken-link checker until the upgrade is complete to reduce the volume of external requests

Patch Information

Contao maintainers fixed the sanitization logic in versions 5.3.47 and 5.7.7. The patched cleaner removes the correct Symfony HttpClient option keys auth_basic and auth_bearer before dispatching requests to non-root-page origins. Refer to the Contao GitHub Security Advisory GHSA-3mr9-p497-58f6 for the complete fix.

Workarounds

Remove Basic and Bearer authentication from contao.crawl.default_http_client_options and restrict crawler access to the target site through IP allow-listing instead
Disable the broken-link checker and any additional configured external URIs until patched versions are deployed
Restrict which content editors can publish outbound links to reduce the chance of attacker-controlled URLs being crawled

bash

# Upgrade Contao via Composer to a patched release
composer require contao/manager-bundle:^5.3.47 --update-with-all-dependencies
# or, for the 5.7 branch
composer require contao/manager-bundle:^5.7.7 --update-with-all-dependencies