CVE-2026-55824: Contao Crawler Exposes Authentication Credentials to External Hosts
Summary
CVE-2026-55824: Contao crawler leaks auth credentials to external hosts. Affects contao/contao across 2 version ranges.
>= 4.13.0, < 5.3.47
>= 5.4.0, < 5.7.7
Fixed in 5.3.47 or 5.7.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that enables users to create and manage websites with ease. It is known for its flexibility, user-friendly interface, and robust features, making it a popular choice for developers and content editors. However, a vulnerability has been identified in its crawler functionality, which can inadvertently leak sensitive authentication credentials to external hosts.
Vulnerability Detail
The vulnerability arises from the Contao crawler's attempt to prevent confidential HTTP client options from being sent to external domains. It creates a scoped client with full options for root page origins and cleaned options for other domains. While it successfully removes Cookie and Authorization headers, it fails to strip the correct Symfony HttpClient authentication options, auth_basic and auth_bearer, instead of the non-Symfony options basic_auth and bearer_auth. As a result, if Basic or Bearer authentication is configured for a protected site, these credentials can be leaked to external URLs crawled by the system, potentially allowing attackers to gain unauthorized access to sensitive environments.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.13.0, < 5.3.475.3.47composer require contao/contao:5.3.47 -
>= 5.4.0, < 5.7.75.7.7composer require contao/contao:5.7.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually strip the actual Symfony HttpClient authentication option keys from the clean client. Modify the code in Factory.php as follows:
if (\in_array($k, ['auth_basic', 'auth_bearer', 'auth_ntlm', 'basic_auth', 'bearer_auth'], true)) {
continue;
}
Conclusion
The vulnerability CVE-2026-55824 in Contao's crawler can lead to the exposure of sensitive authentication credentials to external hosts. It is crucial for users to update their Contao installations to the patched versions to mitigate this risk. Additionally, implementing the suggested workaround can provide temporary relief until the update is applied.
See every vulnerability recorded for contao/contao →
FAQ
CVE-2026-55824 is a vulnerability in the Contao CMS that allows the crawler to leak authentication credentials to external hosts.
If your website uses Contao and has Basic or Bearer authentication configured, an attacker could exploit this vulnerability to gain unauthorized access to protected areas of your site.
Versions 4.13.0 to 5.3.47 and 5.4.0 to 5.7.7 of Contao are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.6, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
