VulnSocial

CVE-2026-90945Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-14); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-14: 1Mentions · 2026-09-15: 1Technical Details · 2026-09-14: 1Technical Details · 2026-09-15: 109-1409-15
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-90945 Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated… https://www.cve.org/CVERecord?id=CVE-2026-90945

    Post summary

    The text discloses CVE-2026-90945, describing a hard-coded JWT signing secret issue in Crawlab through 0.6.3. It links to the CVE record but does not provide PoC, exploit, active exploitation, or remediation information.

    000101.7K
    58.1K followersView on X
  • Severity Daily@severitydaily
    Disclosure

    Crawlab signs administrator JWTs with the hard-coded string "crawlab." Unauthenticated token forgery, CVSS 9.8, no fixed version — and no tagged release since July 2023. https://severitydaily.com/crawlab-cve-2026-90945-hardcoded-jwt-secret-no-release-since-0-6-3/

    Post summary

    The article discloses a critical JWT vulnerability in Crawlab where the hard‑coded secret enables unauthenticated token forgery (CVSS 9.8) and notes that no fixed version is available, with no tagged release since July 2023.

    0000035
    24 followersView on X

Explore more

Back to dashboard