Crawl4AI CVE-2026-109237

Requires a running Crawl4AI server (0.9.0-0.9.3) in API/server mode with the /config/dump endpoint reachable, and the attacker must already possess a valid non-admin API client credential (PR:L). The specific prerequisite is the ability to submit config objects through the API: the untrusted-config gate can be bypassed by wrapping a forbidden LLMConfig inside a dict-type wrapper, with api_token set to an environment reference. Limiting factors: exploitation is NOT possible unauthenticated - a provisioned non-admin token is required - and depends on the deployment exposing the configuration endpoint; pure library/embedded usage without the hosted API server is not affected. Impact is maximized where SECRET_KEY and provider keys are present in the server environment, enabling admin JWT forgery.

This is a credible high-priority issue for anyone running Crawl4AI's server/API mode, though the signals are mixed. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) indicates low-complexity network exploitation requiring only low privileges (a non-admin API client), with high confidentiality and integrity impact - consistent with the description's account of secret leakage leading to admin JWT forgery. The dangerous element is the clear privilege-escalation chain: low-privileged access converts into full administrative control, which is worse than the raw 8.6 score suggests in isolation. However, exploitation is NOT unauthenticated: PR:L confirms the attacker must already hold a valid non-admin API credential, which bounds the exposure to environments that provision such accounts. No EPSS score, KEV listing, SSVC decision data, or POC availability was provided in the input, so exploitation likelihood cannot be quantified from these sources - the assessment rests on the CVSS vector and the detailed, mechanism-specific description from VulnCheck/GHSA. There is no conflict between the CVSS vector and the description; both agree on authenticated remote access with high C/I impact. Treat as a genuine priority for exposed Crawl4AI API deployments, but note that absent EPSS/KEV data, widespread opportunistic exploitation cannot be confirmed.

An attacker holding a low-privilege (non-admin) Crawl4AI API token submits a configuration object with a forbidden LLMConfig laundered inside a dict-type wrapper, bypassing the untrusted-config gate. By setting api_token to an environment reference and posting it to /config/dump, the attacker reads SECRET_KEY and provider keys, then forges an admin JWT to gain full administrative control. No public exploit code was identified in the provided data, but the description details the exact bypass mechanism.