CVE-2026-55824: Contao CMS credential leak in crawler component

CVE-2026-55824 · Severity: low · CVSS 3.1 · Published 2026-07-31

A vulnerability in the Contao CMS crawler component can lead to the accidental disclosure of sensitive login credentials to external websites. When the crawler checks links on a site, it may incorrectly include authentication headers (like those used for staging environments) when visiting third-party links. This could allow an attacker who controls an external website to capture these credentials if they can trick the crawler into visiting their URL.

Technologies: Contao, Contao Core Bundle, contao/contao (Packagist), contao/core-bundle (Packagist). Vendors: Contao, Packagist.

Quick answers

Is CVE-2026-55824 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55824 being exploited in the wild.
How severe is CVE-2026-55824?
Low severity, with a CVSS score of 3.1, published 31 July 2026.
Which products and versions are affected?
Contao >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7, 4.13.40 through 5.3.46, 5.7.0-RC1 through 5.7.6; Contao Core Bundle >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7; contao/contao (Packagist) ECOSYSTEM:introduced=4.13.0,fixed=5.3.47; contao/core-bundle (Packagist) ECOSYSTEM:introduced=4.13.0,fixed=5.3.47.
Is there a fix for CVE-2026-55824?
Yes. contao/contao (Packagist): upgrade to 5.3.47 or later; contao/core-bundle (Packagist): upgrade to 5.3.47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55824 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55824?
Check whether you run Contao, Contao Core Bundle, contao/contao (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • contao/contao (Packagist): upgrade to 5.3.47 or later
    composer require contao/contao:^5.3.47
  • contao/core-bundle (Packagist): upgrade to 5.3.47 or later
    composer require contao/core-bundle:^5.3.47

Technical details

The vulnerability exists in the `Crawl\Escargot\Factory` class of the Contao core-bundle. The `cleanOptionsFromConfidentialData` method attempts to strip sensitive authentication options before the crawler visits external (non-root) URIs. However, it incorrectly targets the keys `basic_auth` and `bearer_auth` instead of the actual Symfony HttpClient keys `auth_basic` and `auth_bearer`. Consequently, if `contao.crawl.default_http_client_options` is configured with credentials, they are leaked in the `Authorization` header to external hosts. Exploitation requires an attacker to place a link on a crawled page and for a crawler task (like the broken-link checker) to be executed by an administrator. Versions 5.3.47 and 5.7.7 contain the fix which correctly identifies and strips the Symfony-specific authentication keys.

Affected products

  • Contao contao/contao >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7
  • Contao contao/core-bundle >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7

Identifiers

  • CVE-2026-55824
  • GHSA-3mr9-p497-58f6

Timeline

  • 2026-06-15: disclosed: Initial disclosure in contao/contao repository
  • 2026-07-31: advisory: Published to NVD
  • 2026-08-06: patched: GitHub Advisory reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.