CVE-2026-90945: Crawlab JWT Auth Bypass Vulnerability

CVE-2026-90945 Overview

Crawlab through version 0.6.3 contains a hard-coded HMAC-SHA256 secret used for JSON Web Token (JWT) signing. The secret is embedded in the application source and cannot be overridden through configuration files or environment variables. Unauthenticated attackers with knowledge of the secret can forge valid JWT tokens for any account, including administrators. Forged administrator tokens grant access to administrative APIs and enable code execution on worker nodes in the distributed crawler cluster. This weakness is tracked as CWE-321: Use of Hard-coded Cryptographic Key.

Critical Impact
Unauthenticated remote attackers can forge administrator JWTs and execute arbitrary code on Crawlab worker nodes.

Affected Products

Crawlab distributed web crawler management platform
All releases through and including version 0.6.3
Both crawlab-core and crawlab service_v2 implementations

Discovery Timeline

2026-09-14 - CVE-2026-90945 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90945

Vulnerability Analysis

Crawlab is an open-source distributed web crawler management platform written in Go. The platform issues JWT tokens to authenticate users against its REST API and worker-node control plane. Token integrity relies on an HMAC-SHA256 signature computed with a shared secret. In Crawlab through 0.6.3, that secret is a compile-time constant stored in the user service source files. The application never reads the secret from an environment variable, configuration file, or secrets store at runtime. Every deployment of a vulnerable release therefore uses the same signing key. Once an attacker recovers the key from the public repository, forged tokens are indistinguishable from legitimate tokens issued by the server.

Root Cause

The root cause is a hard-coded cryptographic key in the user authentication service. The signing secret is present in user/service.go and the newer core/user/service_v2.go implementation. Because the secret ships with every binary and is visible in the public GitHub repository, it provides no cryptographic separation between operators and attackers. Any user of the software inherits the same trust anchor.

Attack Vector

An unauthenticated attacker reads the hard-coded secret from the Crawlab source tree. The attacker then constructs a JWT payload identifying an administrator account, signs it with the stolen secret using HMAC-SHA256, and submits it to the Crawlab API in the Authorization header. The server validates the signature successfully and grants administrative access. From that position, the attacker can invoke management endpoints, schedule spider tasks, and dispatch commands to worker nodes, which results in remote code execution across the cluster. The attack requires only network reachability to the Crawlab API and no user interaction.

// No verified public exploit code is available for CVE-2026-90945.
// See the VulnCheck advisory and the referenced service.go / service_v2.go
// source files for the location of the hard-coded HMAC-SHA256 secret.

Detection Methods for CVE-2026-90945

Indicators of Compromise

Authenticated API requests originating from IP addresses that never completed an interactive /login flow.
JWT tokens presented to the API whose iat or exp claims fall outside the timeframe of any server-issued token.
Unexpected spider or task creation events attributed to the built-in administrator account.
Outbound network connections or shell processes spawned by Crawlab worker containers that do not correspond to scheduled crawl jobs.

Detection Strategies

Log every JWT validation event and correlate the sub claim with recent successful /login responses; forged tokens will lack a matching login.
Alert on administrative API calls, task submissions, and node command dispatches performed outside change-management windows.
Inspect worker-node process trees for child processes of the Crawlab runtime that execute shells, download tools, or write to sensitive paths.

Monitoring Recommendations

Forward Crawlab master and worker logs, along with reverse-proxy access logs, to a centralized analytics platform for retention and correlation.
Baseline normal API consumers by source IP and user agent, then alert on new administrator sessions.
Monitor egress from worker nodes for connections to non-target hosts, which may indicate post-exploitation activity.

How to Mitigate CVE-2026-90945

Immediate Actions Required

Remove Crawlab instances running 0.6.3 or earlier from any network reachable by untrusted users.
Place the management UI and API behind an authenticated reverse proxy or VPN until a fixed release is deployed.
Rotate any credentials, API keys, or cloud tokens that were stored in Crawlab spider configurations or environment variables on worker nodes.
Review task history and node command logs for unauthorized executions since the instance was first exposed.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of publication. Track the Crawlab GitHub Repository and Crawlab Issue Tracker #1622 for a fixed release that reads the JWT signing secret from configuration. Additional technical context is available in the VulnCheck Advisory on Crawlab.

Workarounds

Restrict network access to the Crawlab API and worker ports using firewall rules or Kubernetes NetworkPolicies so that only trusted administrator workstations can connect.
Terminate TLS at a reverse proxy that enforces its own authentication, such as mutual TLS or OIDC, in front of Crawlab.
If comfortable maintaining a private fork, replace the hard-coded secret in user/service.go and core/user/service_v2.go with a value read from an environment variable, and redeploy with a unique high-entropy key per environment.
Invalidate all existing JWTs by changing the secret and forcing users to re-authenticate.

bash

# Example: restrict Crawlab API exposure with iptables until a patched release is installed
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP