PT-2026-51224 · Crawl4Ai · Crawl4Ai

August829 + 6 · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.7

Description The Docker API server contains an authentication bypass issue caused by a hardcoded default JWT (JSON Web Token) signing key. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. Because the secret used to sign these tokens is publicly known, a remote attacker can forge valid tokens for any user to bypass authentication and gain full access to protected functionality.

Recommendations Update to version 0.8.7.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-56265

Affected Products

Crawl4Ai

References · 5

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56265 · Security Note
• https://github.com/unclecode/crawl4ai · Note
• https://vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key · Note
• https://twitter.com/UpwindMDR/status/2068748954129346617 · Twitter Post