CVE-2026-90945

Crawlab, an open-source distributed web crawler admin platform, through version 0.6.3 signs its JWT authentication tokens with a hard-coded HMAC-SHA256 secret that cannot be changed via configuration or environment variables (CWE-321). Because the secret is embedded in the publicly available source code, any unauthenticated attacker can forge valid administrator JWTs and use them against Crawlab's administrative APIs, ultimately achieving remote code execution on worker nodes. The flaw affects every deployment running version 0.6.3 or earlier whose master node or API is reachable by an attacker. It carries a critical CVSS 4.0 score of 9.3 with no privileges or user interaction required. No public proof-of-concept is known and the issue is not listed in CISA's KEV catalog, so exploitation status is currently none known, though the attack is trivially reproducible for anyone who reads the source.

What to do: Upgrade to the latest Crawlab release newer than 0.6.3, where a fix or a configurable JWT secret is expected; do not run fixed-version assumptions without checking the vendor advisory. Until patched, remove the master node's API from the public internet by placing it behind a VPN or an authenticating reverse proxy, since network reachability is the only barrier to exploitation. Review logs for anomalous administrative API usage or unexpected task/spider deployments on workers, and treat any such activity as a potential compromise requiring credential and secret rotation.