CVE-2026-55824 Contao crawler leaks auth credentials to external hosts
Contao CMS leaks Basic or Bearer authentication credentials to external hosts when crawling links, exposing sensitive access tokens to attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55824?
CVE-2026-55824 is a low-severity vulnerability in contao, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.
Weakness: CWE-200
Which versions are affected by CVE-2026-55824?
8 open source packages ship an affected version, including contao/contao and contao/core-bundle.
| Package | Affected | Fixed in |
|---|---|---|
contao/contao Packagist | From 4.13.0 | 5.3.47 |
contao/contao Packagist | From 4.13.0 | 5.3.47 |
contao/contao Packagist | From 5.4.0 | 5.7.7 |
contao/contao Packagist | From 5.4.0 | 5.7.7 |
contao/core-bundle Packagist | From 4.13.0 | 5.3.47 |
contao/core-bundle Packagist | From 4.13.0 | 5.3.47 |
2 more packages
contao/core-bundle Packagist | From 5.4.0 | 5.7.7 |
contao/core-bundle Packagist | From 5.4.0 | 5.7.7 |
How do I fix CVE-2026-55824?
Upgrade contao/contao to a fixed version for your release line: 5.3.47 or 5.7.7.
Is CVE-2026-55824 being exploited?
There is no known exploitation of CVE-2026-55824 in the wild and no public exploit code.
Sources
Also known as GHSA-3mr9-p497-58f6.