Crawlab Hard-Coded JWT Secret Authentication Bypass

Technical Analysis

The vulnerability stems from Crawlab's use of a static, code-embedded HMAC-SHA256 signing key for JWT authentication tokens rather than a per-deployment secret generated at install time or supplied via secure configuration. Because the key is identical across all installations, an attacker can extract it from public source code or binaries and use standard JWT libraries to craft tokens with administrator-level claims, bypassing authentication entirely (CVE-2026-90945, CVSS 9.8). Once authenticated as an administrator, the attacker can reach privileged APIs that manage distributed crawler worker nodes, enabling arbitrary task/script execution and effectively remote code execution across the cluster. Organizations that deploy Crawlab as part of automated data collection pipelines feeding RAG systems or AI agents are directly exposed: a compromised Crawlab instance can be used to poison scraped data ingested by agents, exfiltrate API keys or credentials stored in worker environments, or pivot to other agent infrastructure sharing the same network, making this a high-priority agent-relevant supply-chain risk.

Affected Systems

Crawlab (open-source distributed web crawler management platform) versions up to and including 0.6.3, all deployment modes (Docker, Kubernetes, bare-metal) that use default JWT authentication with no configuration override capability for the signing secret

Indicators of Compromise

• No specific file hashes or IPs published; indicators include unexpected administrator API calls from unauthenticated/unknown JWT tokens, unusual worker node task execution, JWTs with the shared hard-coded HMAC-SHA256 signature validating outside expected issuer context, anomalous access to Crawlab admin endpoints (/api/users, /api/nodes, /api/tasks) from unrecognized source IPs

Remediation Steps

1. 1

   Upgrade Crawlab

   Update to a patched Crawlab release once available that supports configurable, per-deployment JWT signing secrets.

2. 2

   Restrict network exposure

   Place Crawlab management interfaces and APIs behind VPN, firewall rules, or a reverse proxy with authentication until patched; never expose the admin API directly to the internet.

3. 3

   Rotate credentials

   Rotate all admin credentials, API keys, and any secrets accessible to Crawlab worker nodes, especially those used by connected AI agent or data pipeline systems.

4. 4

   Monitor for forged tokens

   Implement logging and anomaly detection on JWT usage, watching for tokens issued outside normal authentication flows or with unexpected claims.

5. 5

   Isolate worker nodes

   Segment Crawlab worker nodes from sensitive internal networks and agent infrastructure to limit lateral movement if compromise occurs.