Description

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T18:20:29.030Z",
  "pubdate": "2026-09-14T18:20:29.030Z",
  "executiveSummary": "Crawlab versions up to and including 0.6.3 contain a critical security vulnerability involving the use of a hard-coded secret key for HMAC-SHA256 JWT (JSON Web Token) signing.\nBecause the secret key is embedded within the application source code and cannot be overridden by users through configuration files or environment variables, the integrity and authenticity of the authentication mechanism are entirely compromised.\nThis flaw allows unauthenticated remote attackers to perform cryptographic signing of arbitrary JWTs. By generating tokens with elevated claims, attackers can impersonate administrative users.\nThe successful exploitation of this vulnerability grants full unauthorized access to administrative APIs. Given the nature of the Crawlab platform, this access effectively allows an attacker to control worker nodes and achieve Remote Code Execution (RCE) by leveraging administrative functionality to deploy and execute malicious tasks.\nThe risk level is critical, as it bypasses all native authentication controls without requiring prior valid credentials or user interaction.",
  "technicalDetails": "The vulnerability originates from the implementation of the JWT signing process within the Crawlab application. The backend utilizes a static, hard-coded string as the secret key for the HMAC-SHA256 (HS256) signing algorithm. This key is stored directly within the application binary or source files, making it retrievable through static analysis or reverse engineering.\nBecause the mechanism lacks a provision to rotate or define this key externally via environment variables or configuration files, the security of the entire authentication subsystem is static and globally predictable across all deployments.\nThe exploitation flow begins with the identification of the hard-coded secret. Once the secret is extracted, an attacker can construct a malicious JWT header and payload. The header defines the algorithm as HS256, and the payload is crafted to include claims such as 'role: admin' or specific administrative user IDs.\nThe attacker then signs the malicious payload using the extracted hard-coded secret key. Because the server-side logic uses the same static key to verify incoming tokens, the forged token will be cryptographically validated as authentic by the backend.\nUpon successful validation, the attacker gains the authorization context associated with the forged identity. This provides unrestricted access to sensitive administrative endpoints. Attackers can interact with the API to manage tasks, retrieve system credentials, and inject malicious scripts or commands intended for worker node execution.\nThe impact is comprehensive; as Crawlab is designed to orchestrate distributed spider tasks, the ability to execute arbitrary code on worker nodes via the administrative API represents a total system compromise. The vulnerability is present in versions up to 0.6.3 and requires only network access to the API surface, with no prerequisites for authentication or administrative knowledge."
}