Executive brief
A vulnerability in the Contao CMS crawler component can lead to the accidental disclosure of sensitive login credentials to external websites. When the crawler checks links on a site, it may incorrectly include authentication headers (like those used for staging environments) when visiting third-party links. This could allow an attacker who controls an external website to capture these credentials if they can trick the crawler into visiting their URL.
Technical details
The vulnerability exists in the `Crawl\Escargot\Factory` class of the Contao core-bundle. The `cleanOptionsFromConfidentialData` method attempts to strip sensitive authentication options before the crawler visits external (non-root) URIs. However, it incorrectly targets the keys `basic_auth` and `bearer_auth` instead of the actual Symfony HttpClient keys `auth_basic` and `auth_bearer`. Consequently, if `contao.crawl.default_http_client_options` is configured with credentials, they are leaked in the `Authorization` header to external hosts. Exploitation requires an attacker to place a link on a crawled page and for a crawler task (like the broken-link checker) to be executed by an administrator. Versions 5.3.47 and 5.7.7 contain the fix which correctly identifies and strips the Symfony-specific authentication keys.
Affected products
- Contao contao/contao >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7
- Contao contao/core-bundle >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7
Timeline
- 2026-06-15: disclosed: Initial disclosure in contao/contao repository
- 2026-07-31: advisory: Published to NVD
- 2026-08-06: patched: GitHub Advisory reviewed and published