crawlab-team

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

crawlab-team records in CISA KEV

No crawlab-team vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-61809 CVE-2026-90945 · GHSA-rq87-w7pv-64x4

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

HIGH 81

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00765 Published 2026-09-14 No fix listed CWE-321

TI-2026-52766 CVE-2026-75103 · GHSA-jm7g-x36v-768h

Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

HIGH 73

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00624 Published 2026-08-17 No fix listed CWE-639

Open these records in search →

Critical	1
High	1
Medium	0
Low	0
No CVSS	0