CVE-2026-90945 crawlab-team CVE debrief

Who should care

System administrators and security teams responsible for managing and monitoring web crawlers using Crawlab should assess their exposure and prioritize remediation by verifying the version of Crawlab in use, reviewing compensating controls, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-90945 is a critical vulnerability in Crawlab that allows unauthenticated attackers to forge administrator tokens and execute code on worker nodes. System administrators and security teams should assess their exposure and prioritize remediation.

• Unauthenticated attackers can forge administrator tokens to access administrative APIs.
• Attackers can execute code on worker nodes, potentially leading to data breaches or system compromise.
• Verify the version of Crawlab in use and assess exposure to this vulnerability.
• Remediation requires updating Crawlab to a version that allows overriding the HMAC-SHA256 secret.

Technical summary

The vulnerability is caused by a hard-coded HMAC-SHA256 secret used for signing JWT tokens in Crawlab versions up to 0.6.3. This secret cannot be overridden via configuration or environment variables, allowing unauthenticated attackers to forge valid administrator tokens. These tokens grant access to administrative APIs, enabling attackers to execute code on worker nodes. System administrators and security teams should assess their exposure and prioritize remediation by updating Crawlab to a version that allows overriding the HMAC-SHA256 secret.

Defensive priority

High priority for systems using Crawlab versions up to 0.6.3; verify and remediate immediately.

Recommended defensive actions

• Verify the version of Crawlab in use and assess exposure.
• Implement compensating controls, such as monitoring for suspicious token usage.
• Remediate by updating Crawlab to a version that allows overriding the HMAC-SHA256 secret.
• Review and restrict access to administrative APIs.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3. The source references include links to the Crawlab GitHub repository and a Vulncheck advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.