EUVD-2026-77712
GHSA-rq87-w7pv-64x4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secret is public in source so token forgery needs no privileges (PR:N) and low complexity (AC:L); forged admin access yields RCE on workers, giving full C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
AnalysisAI
Unauthenticated remote attackers can forge administrator JSON Web Tokens in Crawlab through 0.6.3 because the application ships a static HMAC-SHA256 signing secret that operators cannot override through configuration files or environment variables; forged tokens grant access to administrative APIs and, from there, code execution on worker nodes. Affected are all deployments of Crawlab 0.6.3 and earlier, including default installations, with the only prerequisite being network reachability to the admin API and no user interaction or authentication required (CVSS:4.0 base 9.3, PR:N; independent assessment CVSS:3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network reachability - remote unauthenticated exploitation works against default and all configurations of Crawlab through 0.6.3, because the HMAC-SHA256 JWT signing secret is hard-coded and explicitly cannot be changed via configuration files or environment variables, so operators have no mitigation short of network isolation or upgrading. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority critical, not an inflated-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the supplied references point to the repository and issue tracker rather than a fixed release, so operators should monitor https://github.com/crawlab-team/crawlab, the upstream issue at https://github.com/crawlab-team/crawlab/issues/1622 and the VulnCheck advisory at https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret for a version beyond 0.6.3 and upgrade immediately once one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory every Crawlab deployment at version 0.6.3 or earlier, including test, lab, and developer instances, and immediately remove network reachability to the admin API from untrusted networks by restricting it to a management VLAN, VPN, or explicit allowlist - no vendor-released patch identified at time of analysis means there is no fixed version to upgrade to. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allShare
External POC / Exploit Code
Leaving vuln.today