CVE-2026-75103: Crawlab Authentication Bypass Vulnerability

CVE-2026-75103 Overview

Crawlab, an open-source distributed web crawler management platform, contains a missing authorization flaw on its password-change endpoint. The endpoint fails to verify user ownership or administrative role, allowing any authenticated user to change any other account's password. Attackers combine this with the user listing endpoint to enumerate accounts, target administrators, and take over privileged sessions. Because Crawlab administrators can schedule and execute crawler code, account takeover leads directly to arbitrary code execution on the host. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any low-privilege authenticated Crawlab user can reset an administrator's password, hijack the account, and execute arbitrary code through crawler task scheduling.

Affected Products

Crawlab (crawlab-team/crawlab) distributed web crawler management platform
Deployments exposing the user_v2 controller password-change endpoint
Self-hosted Crawlab instances reachable by authenticated low-privilege users

Discovery Timeline

2026-08-17 - CVE-2026-75103 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75103

Vulnerability Analysis

Crawlab exposes an authenticated HTTP endpoint that changes a user's password based on a user identifier supplied in the request. The handler in core/controllers/user_v2.go accepts the target user ID and new password from the caller and performs the password update against the database. The handler does not compare the target ID against the authenticated session, and it does not check whether the caller holds an administrative role. Any authenticated principal can therefore mutate credentials belonging to any other principal, including the built-in administrator.

A parallel user listing endpoint returns account records to authenticated callers, providing the attacker with the identifiers required to target the highest-privilege accounts. Once the administrator password is overwritten, the attacker authenticates as the administrator and gains full control of scheduled crawler tasks, node execution, and configuration. Crawler tasks execute arbitrary code by design, so the takeover chain terminates in remote code execution on Crawlab worker nodes.

Root Cause

The root cause is a missing authorization check on a resource-modifying endpoint. The controller trusts the client-supplied user identifier as the authorization key rather than deriving it from the authenticated session or gating the operation on an administrator role. This pattern maps directly to CWE-639, where access decisions rely on values the caller can freely modify.

Attack Vector

Exploitation is network-based and requires only low-privilege authenticated access, which any registered Crawlab user holds. The attacker first calls the user listing endpoint to enumerate accounts and identify administrators. The attacker then issues a password-change request specifying the administrator's user ID and a chosen password. After the response confirms the change, the attacker authenticates as the administrator and schedules a malicious crawler task that runs attacker-controlled code on the Crawlab node. Full technical details are documented in the VulnCheck advisory and referenced against the Crawlab user controller source.

No verified proof-of-concept code is published in the enriched data for this CVE. Refer to the vendor issue at Crawlab Issue #1623 for tracking and technical discussion.

Detection Methods for CVE-2026-75103

Indicators of Compromise

Successful HTTP requests to the Crawlab password-change route where the target user ID does not match the authenticated caller's user ID.
Administrator logins originating from IP addresses, user agents, or geolocations not previously associated with that administrator account.
Newly created or modified crawler tasks that invoke shell commands, download remote payloads, or spawn interpreters such as bash, sh, python, or curl.
Sequential access to the user listing endpoint followed shortly by password-change requests from the same session token.

Detection Strategies

Instrument the Crawlab reverse proxy or application logs to flag password-change requests whose payload user ID differs from the session's user ID.
Alert when the same session performs both user enumeration and password mutation within a short time window.
Baseline administrator authentication patterns and alert on anomalous source addresses, session reuse, or off-hours logins.
Track process lineage on Crawlab worker nodes to identify unusual child processes launched from the crawler runtime.

Monitoring Recommendations

Forward Crawlab application, authentication, and process telemetry into a centralized analytics platform for correlation across identity and endpoint signals.
Retain crawler task definitions and execution history to support retrospective hunts for malicious scheduled jobs.
Monitor outbound network connections from Crawlab worker nodes for unexpected destinations that may indicate payload retrieval or command-and-control activity.

How to Mitigate CVE-2026-75103

Immediate Actions Required

Restrict network exposure of the Crawlab web interface and API to trusted management networks or a VPN until a patched release is deployed.
Rotate all Crawlab account passwords, especially administrator credentials, and invalidate active sessions to evict any attacker who already exploited the flaw.
Audit the user list for unauthorized accounts and review recent crawler task definitions for injected commands or unexpected script sources.
Disable or remove unused accounts to reduce the pool of authenticated principals that can reach the vulnerable endpoint.

Patch Information

At the time of publication, the enriched CVE record does not list a fixed version. Track the upstream project at the GitHub Crawlab repository and the associated Crawlab Issue #1623 for a security release. Apply the patched build as soon as maintainers publish it, and validate that the password-change handler in core/controllers/user_v2.go enforces both session-derived identity and administrative role checks.

Workarounds

Place the Crawlab API behind a reverse proxy that blocks or requires additional authentication for the password-change route until a patch is available.
Enforce network segmentation so only administrators can reach the Crawlab management endpoints, reducing exposure of the vulnerable route to low-privilege users.
Where feasible, run Crawlab worker nodes as non-privileged users inside sandboxed containers to limit the blast radius of arbitrary code execution through hijacked tasks.

bash

# Example nginx snippet restricting the vulnerable route to a management CIDR
location ~ ^/api/users/.+/change-password$ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://crawlab_backend;
}