crawlab vulnerabilities

2 known vulnerabilities in crawlab from Crawlab-team. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  crawlab: Use of Hard-coded Cryptographic Key

  CVE-2026-90945Sep 14, 2026Crawlab-team

  Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code

• 8.8 High severity

  crawlab: Authorization Bypass Through User-Controlled Key

  CVE-2026-75103Aug 17, 2026Crawlab-team

  Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator cre