CVE-2026-56265: Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server

June 21, 2026 (updated September 14, 2026)

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

References

github.com/advisories/GHSA-8qrg-7j2f-rf2h
github.com/unclecode/crawl4ai/releases/tag/v0.8.7
github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
nvd.nist.gov/vuln/detail/CVE-2026-56265
www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key

Code Behaviors & Features

Detect and mitigate CVE-2026-56265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →