CVE-2026-90945

Katalog CVE

CVSS 9.8 · Critical EPSS 0,77%

Kerentanan Use of Hard-coded Cryptographic Key. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/crawlab-team/crawlab
• https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go
• https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go
• https://github.com/crawlab-team/crawlab/issues/1622
• https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret