# CVE-2026-55824: Contao CMS credential leak in crawler component

Source: https://junglewise.ai/threats/cve-2026-55824-contao-cms-credential-leak-in-crawler-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-55824 · Severity: low · CVSS 3.1 · Published 2026-07-31

A vulnerability in the Contao CMS crawler component can lead to the accidental disclosure of sensitive login credentials to external websites. When the crawler checks links on a site, it may incorrectly include authentication headers (like those used for staging environments) when visiting third-party links. This could allow an attacker who controls an external website to capture these credentials if they can trick the crawler into visiting their URL.

Technologies: [Contao](https://junglewise.ai/threats/technologies/contao), [Contao Core Bundle](https://junglewise.ai/threats/technologies/core-bundle), [contao/contao (Packagist)](https://junglewise.ai/threats/technologies/contao-contao), [contao/core-bundle (Packagist)](https://junglewise.ai/threats/technologies/contao-core-bundle). Vendors: [Contao](https://junglewise.ai/threats/vendors/contao), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55824 being exploited in the wild.

**How severe is CVE-2026-55824?** Low severity, with a CVSS score of 3.1, published 31 July 2026.

**Which products and versions are affected?** Contao >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7, 4.13.40 through 5.3.46, 5.7.0-RC1 through 5.7.6; Contao Core Bundle >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7; contao/contao (Packagist) ECOSYSTEM:introduced=4.13.0,fixed=5.3.47; contao/core-bundle (Packagist) ECOSYSTEM:introduced=4.13.0,fixed=5.3.47.

**Is there a fix for CVE-2026-55824?** Yes. contao/contao (Packagist): upgrade to 5.3.47 or later; contao/core-bundle (Packagist): upgrade to 5.3.47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55824 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55824?** Check whether you run Contao, Contao Core Bundle, contao/contao (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- contao/contao (Packagist): upgrade to 5.3.47 or later

  ```sh
  composer require contao/contao:^5.3.47
  ```

- contao/core-bundle (Packagist): upgrade to 5.3.47 or later

  ```sh
  composer require contao/core-bundle:^5.3.47
  ```


## Technical details

The vulnerability exists in the `Crawl\Escargot\Factory` class of the Contao core-bundle. The `cleanOptionsFromConfidentialData` method attempts to strip sensitive authentication options before the crawler visits external (non-root) URIs. However, it incorrectly targets the keys `basic_auth` and `bearer_auth` instead of the actual Symfony HttpClient keys `auth_basic` and `auth_bearer`. Consequently, if `contao.crawl.default_http_client_options` is configured with credentials, they are leaked in the `Authorization` header to external hosts. Exploitation requires an attacker to place a link on a crawled page and for a crawler task (like the broken-link checker) to be executed by an administrator. Versions 5.3.47 and 5.7.7 contain the fix which correctly identifies and strips the Symfony-specific authentication keys.

## Affected products

- Contao contao/contao >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7
- Contao contao/core-bundle >= 4.13.0, < 5.3.47; >= 5.4.0, < 5.7.7

## Identifiers

- CVE-2026-55824
- GHSA-3mr9-p497-58f6

## Timeline

- 2026-06-15: disclosed: Initial disclosure in contao/contao repository
- 2026-07-31: advisory: Published to NVD
- 2026-08-06: patched: GitHub Advisory reviewed and published

## References

- [https://api.github.com/users/0x1saac](https://api.github.com/users/0x1saac)
- [https://github.com/0x1saac](https://github.com/0x1saac)
- [https://api.github.com/users/0x1saac/gists%7B/gist_id%7D](https://api.github.com/users/0x1saac/gists%7B/gist_id%7D)
- [https://api.github.com/users/0x1saac/repos](https://api.github.com/users/0x1saac/repos)
- [https://avatars.githubusercontent.com/u/182232496?v=4](https://avatars.githubusercontent.com/u/182232496?v=4)
- [https://api.github.com/users/0x1saac/events%7B/privacy%7D](https://api.github.com/users/0x1saac/events%7B/privacy%7D)

## Related threats

- [Contao path traversal in image insert tag](https://junglewise.ai/threats/cve-2026-126663-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao access control bypass in file manager Edit-Multiple](https://junglewise.ai/threats/cve-2026-126662-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao improper access control in table access voter](https://junglewise.ai/threats/cve-2026-107851-contao-improper-access-control-in-the-table-access-voter)
- [Contao improper access control in preview links module](https://junglewise.ai/threats/cve-2026-107850-contao-improper-access-control-in-the-preview-links-module)
- [Contao: Cross-site request forgery in custom backend actions](https://junglewise.ai/threats/cve-2026-107848-contao-cross-site-request-forgery-in-custom-backend-actions)