Crawl4AI CVE-2026-109238

Exploitation requires the link_preview_config feature to be enabled on /crawl requests, and the attacker must supply a controlled page with include_external and include_patterns set so that AsyncUrlSeeder follows and fetches the referenced internal, private, or cloud-metadata links. The affected version range is Crawl4AI 0.7.0 up to (not including) 0.9.4. Limiting factors: link_preview_config is a non-default feature that must be active, and the Crawl4AI /crawl API must be network-reachable by the attacker; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), so against a reachable instance with the feature enabled there are no further barriers.

This is a genuinely high-priority flaw for affected deployments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and the high-vendor-score (9.2) is driven by VC:H plus a subsequent-system confidentiality impact (SC:H) reflecting that the SSRF can reach cloud-metadata endpoints and exfiltrate their parsed contents - a realistic path to IAM credential theft in cloud environments. However, the signals are not uniformly severe: exploitation is gated on a specific non-default feature (link_preview_config enabled on /crawl, with include_external and include_patterns set), which the raw CVSS does not capture, so the PR:N/AC:L rating overstates ease against default installs. No EPSS score was provided, so exploitation probability cannot be quantified. It is not on CISA KEV and no public POC was supplied in the input, so there is no evidence of active or widespread exploitation - current risk is 'high potential, unproven in-the-wild.' Net: prioritize patching where link preview is enabled and the service is internet-exposed, but the no-special-config default posture materially lowers real-world exposure versus the headline score.

An attacker sends a /crawl API request to an exposed Crawl4AI instance with link_preview_config enabled, pointing at an attacker-controlled page whose include_external and include_patterns are configured to reference internal, private, or cloud-metadata URLs (e.g., 169.254.169.254). AsyncUrlSeeder follows those links from the server side and returns the parsed head data, letting the attacker read internal service responses or cloud instance metadata. No authentication or user interaction is required per the CVSS vector, though no public exploit was identified at time of analysis.