EUVD-2026-51613
GHSA-3mr9-p497-58f6
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Attacker must control an external URL actually visited by the crawler and influence crawlable content (AC:H, PR:L); only credentials are exposed with no integrity or availability impact (C:L/I:N/A:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.
AnalysisAI
Contao CMS's crawler leaks HTTP authentication credentials to external hosts due to an option-name mismatch in its credential-scrubbing logic, affecting versions 4.13.40-5.3.46 and 5.7.0-RC1-5.7.6. The cleaner is coded to remove the non-existent keys basic_auth and bearer_auth rather than Symfony HttpClient's actual auth_basic and auth_bearer options, so credentials configured in contao.crawl.default_http_client_options are silently passed through to external domains. An attacker who can place an external link on any page crawled by Contao's broken-link checker can receive those credentials on an attacker-controlled server. No public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
Contao's crawler uses Symfony HttpClient and implements a scoped-client pattern: it creates a 'full-options' client for requests to the site's own root-page origins and a 'cleaned-options' client for all other destinations. The cleaning step is intended to strip authentication headers (Cookie, Authorization) and the corresponding Symfony option keys. However, the code references basic_auth and bearer_auth - keys that do not exist in Symfony HttpClient's option schema - rather than the correct auth_basic and auth_bearer. Because those keys are never present in the options array, the removal is a no-op and the real credential options pass through unmodified. This is a classic CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rooted in an API contract misunderstanding. The broken-link checker extends the attack surface because it actively follows external links discovered during a crawl, widening the set of attacker-reachable trigger points.
RemediationAI
Upgrade to Contao 5.3.47 or 5.7.7, which correctly strip the auth_basic and auth_bearer Symfony HttpClient options before issuing requests to external domains. The vendor advisory is at https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6. If immediate patching is not feasible, the most effective compensating control is to remove Basic or Bearer credentials from contao.crawl.default_http_client_options entirely; the trade-off is that the crawler can no longer authenticate to protected pages, potentially generating false-positive broken-link reports. A secondary option is to disable the broken-link checker, which removes the main mechanism by which an attacker can cause the crawler to visit attacker-controlled URLs without already having page-edit access; this degrades site maintenance capability. Network-level blocking of outbound crawler requests to untrusted external hosts (e.g., via egress firewall rules or proxy allowlists) would also prevent credential leakage but requires infrastructure-level changes. None of the workarounds substitute for patching.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today