Crallab npm Package Vulnerability: Critical CVE-2026-90945 Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- crawlab (npm)
- Affected versions
- >= v0.6.3-dev, <= v0.6.3-dev or >= v0.6.0-beta.20210803, <= v0.6.0-beta.20210803 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.10, <= v0.4.10 or >= v0.4.9, <= v0.4.9 or >= v0.4.8, <= v0.4.8 or >= v0.4.7, <= v0.4.7 or >= v0.4.6, <= v0.4.6 or >= v0.4.5, <= v0.4.5 or >= v0.4.4, <= v0.4.4 or >= v0.4.3, <= v0.4.3 or >= v0.4.2, <= v0.4.2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.5, <= v0.3.5 or >= v0.3.4, <= v0.3.4 or >= v0.3.3, <= v0.3.3 or >= v0.3.2, <= v0.3.2 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.4, <= v0.2.4 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2, <= v0.2 or >= v0.1.1, <= v0.1.1 or >= v0.1, <= v0.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Crallab npm package. Versions from 0.1 to 0.6.3 are reportedly affected by a hard-coded HMAC-SHA256 secret for JWT token signing.
What happened
Crallab through version 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden. This design flaw allows unauthenticated attackers to forge valid administrator tokens. With such tokens, attackers can access administrative APIs and execute code on worker nodes. The vulnerability is tracked as CVE-2026-90945 with a CVSS score of 9.8, indicating a critical severity level.
The vulnerability was first flagged on September 14, 2026. It is under investigation and has not been reported as exploited in the wild. However, the potential impact is significant, as it could allow complete compromise of systems running affected versions of Crallab.
What to do about it
- Upgrade Crallab to a version that fixes the hard-coded secret issue as soon as it is available.
- Rotate any existing JWT secrets to prevent their use by potential attackers.
- Monitor the primary sources for updates on patched versions and further guidance.
- Review your system's access logs for any signs of unauthorized administrative access.
- Consider implementing additional security measures to detect and respond to potential exploitation attempts.
How 0Day would have caught this
crawlab is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Crallab npm package versions from 0.1 to 0.6.3, you are potentially affected by this vulnerability.
What should I do right now?
Monitor the primary sources for updates on a fix. Prepare to upgrade Crallab and rotate JWT secrets as soon as a patched version is available.
Is there an official fix available yet?
No official fix has been published yet. Continue to monitor the sources for updates.
How can I detect if my system has been compromised?
Review your system's access logs for any signs of unauthorized administrative access as a preliminary step.