CVE-2026-55824 in Contao
Summary
by MITRE • 07/31/2026
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in Contao CMS represents a critical authentication credential leakage flaw that affects versions ranging from 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6. This security issue stems from improper handling of HTTP client authentication options within the crawler component, creating a pathway for sensitive credentials to be transmitted to external hosts. The vulnerability specifically targets the crawler's attempt to implement security controls by creating scoped HTTP clients that should restrict confidential options when connecting to external domains. While the system correctly identifies and removes standard HTTP headers such as Cookie and Authorization, it fails to properly handle Symfony HttpClient's authentication option naming conventions.
The technical flaw manifests in the crawler's credential cleaning mechanism which incorrectly processes authentication options by removing non-Symfony named parameters like basic_auth and bearer_auth instead of the actual Symfony HttpClient options auth_basic and auth_bearer. This misconfiguration means that when Contao's crawler encounters protected sites requiring Basic or Bearer authentication, the authentication credentials remain embedded in the HTTP client configuration even when targeting external domains. The system's security controls are therefore bypassed because the cleaning process operates on incorrect parameter names, leaving sensitive authentication information accessible to external hosts.
The operational impact of this vulnerability is significant as it allows attackers to potentially harvest authentication credentials through legitimate crawling operations. An attacker can exploit this weakness by crafting links that will be processed by Contao's crawler with the broken-link checker enabled, causing the crawler to visit their malicious external domains while still carrying the original authentication credentials in its HTTP client configuration. This credential leakage could provide unauthorized access to protected staging or production environments, particularly when these systems are configured with sensitive credentials that should not be exposed outside their intended domain boundaries.
The vulnerability aligns with CWE-200 (Information Exposure) and CWE-540 (Inclusion of Sensitive Information in Source Code) categories, representing a clear information disclosure issue where authentication credentials flow outside their intended security context. From an ATT&CK framework perspective, this maps to T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS) through the exploitation of crawler functionality to exfiltrate credentials, and potentially T1528 (Steal Application Access Token) when bearer authentication tokens are compromised. The fix implemented in versions 5.3.47 and 5.7.7 addresses this issue by correcting the credential cleaning process to properly identify and remove Symfony HttpClient's actual authentication options rather than incorrect parameter names, ensuring that sensitive credentials are appropriately scrubbed before external communication occurs.
Organizations using Contao CMS should immediately upgrade to the patched versions to mitigate this vulnerability and conduct thorough security reviews of their crawler configurations. System administrators should also implement additional monitoring for unexpected external connections from their CMS infrastructure and consider implementing network-level controls to restrict outbound crawling activities to prevent credential leakage. The fix demonstrates the importance of proper parameter handling in security-sensitive components and highlights the need for careful validation of authentication option names when implementing client-side security measures that interface with third-party systems.