CVE-2026-56265: Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Synopsis

Authentication bypass in Crawl4AI's Docker API server allows unauthenticated remote attackers to forge valid JWT tokens using a hardcoded default signing key. Because the signing key is fixed in the source code, any attacker who knows it (or finds it in public repositories) can craft tokens for any user identity without supplying real credentials. Successful exploitation gives full access to all protected API functionality, including the ability to read crawled data, trigger crawl jobs, and modify server behavior. A patched-image rebuild at version 0.8.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API server is exposed over the network, so an attacker must be able to reach it via HTTP/HTTPS to send forged JWT tokens.

• AuthenticationNot required

  No valid credentials are needed; the attacker forges authentication tokens using the publicly known hardcoded signing key, bypassing the authentication layer entirely.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to sign a JWT with the known default key, with no race conditions or environmental dependencies involved.

Blast Radius

• Attacker reads any data accessible through the Crawl4AI API, including crawled page content and stored results, by impersonating arbitrary user identities.
• Attacker submits and controls crawl jobs, directing the server to fetch attacker-chosen URLs and consume server resources.
• Attacker modifies server-side configuration or job state through protected API endpoints, tampering with scheduled or in-progress crawl operations.
• Attacker disrupts service availability by flooding or misconfiguring the crawl queue, crashing or degrading the API server for all users.