CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56265 — Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a h...

·Source: NIST NVD

Updated:

Executive Summary

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Analysis

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality. CVSS Score: 9.8. Published: 2026-06-21T14:16:24.980.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56265
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 21, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Australia warns of global campaign targeting vulnerable CMS platforms

The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable content management systems (CMS) and plugins. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-61447 — PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAg...

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

CVE-2026-61447
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-61445 — PraisonAI before 4.6.78 contains arbitrary file write and command execution vuln...

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

CVE-2026-61445
NIST NVD