This critical vulnerability in Crawlab is actively exploited in the wild and allows unauthenticated attackers to gain administrative control and execute arbitrary code.

The application utilizes a hard-coded HMAC-SHA256 secret for JWT token signing, which cannot be modified via configuration. This allows unauthenticated attackers to generate valid administrative tokens to access sensitive APIs and perform remote code execution on worker nodes.

The ability for an unauthenticated attacker to gain administrative access presents a total compromise of the application and its underlying infrastructure. With a CVSS score of 9.8, this flaw represents the highest level of risk, potentially leading to unauthorized data exfiltration, full system takeover, and lateral movement within the network.

Immediate Action: There is currently no vendor-supplied patch; administrators should immediately isolate affected instances from the internet and restrict access to the administrative API.

Proactive Monitoring: Monitor server logs for unauthorized API requests and unusual token usage, specifically looking for tokens that do not originate from legitimate login sessions.

Compensating Controls: Deploy a Web Application Firewall to block suspicious traffic patterns directed at administrative endpoints and monitor worker nodes for unauthorized process execution.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and its confirmed status in the CISA KEV catalog, immediate action is required. Organizations should treat this as a high-priority incident, isolate affected systems, and maintain strict network access controls until a security update is provided by the vendor.