Executive brief
Crawlab is a distributed web crawler management platform used to administer spider tasks across multiple nodes. The platform uses a hardcoded cryptographic secret for signing authentication tokens that cannot be changed, allowing attackers without credentials to forge administrator tokens and gain full control over the platform, including the ability to execute arbitrary code on all worker nodes.
Technical details
Crawlab through version 0.6.3 uses a hardcoded HMAC-SHA256 secret for JWT token signing that is embedded in the application code and cannot be overridden via configuration files or environment variables. This vulnerability is a cryptographic key management failure (CWE-321). An unauthenticated attacker can leverage knowledge of this hardcoded secret to forge valid JWT tokens with administrator claims, bypassing authentication entirely. No preconditions are required—the attacker only needs network access to the Crawlab administrative API. A successful exploit grants an attacker administrative privileges to execute arbitrary commands on worker nodes through the platform's administrative interfaces. Patches or version updates beyond 0.6.3 should address this issue by supporting dynamic, securely-configured JWT secrets.
Affected products
- Crawlab Team Crawlab through 0.6.3
Timeline
- 2026-09-14: disclosed