Crawl4AI CVE-2026-109239

Exploitation requires reaching the Crawl4AI Docker service (the egress-controlled component referenced in the description) and exercising the robots.txt-fetch path via RobotsParser.can_fetch - i.e., the check_robots_txt behavior must be in effect when the server processes an attacker-influenced target URL. The attack specifically leverages HTTP redirects or DNS rebinding to defeat address/egress filtering and reach loopback, internal, or cloud-metadata endpoints. Limiting factors: the SSRF is blind (no direct response disclosure, lowering data-exfiltration value to confidentiality:low), impact is maximized only in cloud environments that expose a metadata service, and realistic risk assumes the Docker server is reachable by untrusted callers; if check_robots_txt is not engaged for attacker-supplied URLs, the path is not triggered.

This is a CVSS 4.0 6.9 (Medium) blind SSRF (CWE-918) in Crawl4AI's RobotsParser.can_fetch. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) indicates a network-reachable, low-complexity, unauthenticated flaw whose only measurable direct impact is low confidentiality (VC:L) with no integrity or availability impact - consistent with a *blind* SSRF used for service discovery and egress-control bypass rather than direct data theft. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no public evidence of active exploitation or weaponization; the real-world threat is currently inferred from the primitive itself (reaching loopback, internal, and cloud-metadata endpoints such as 169.254.169.254), which can be high-value in cloud deployments where metadata exposes credentials. The practical risk is tempered by the blind nature (attacker does not directly see responses) and by the dependency on the check_robots_txt behavior being engaged. Net: a legitimate priority for anyone running the Crawl4AI Docker service exposed to untrusted input, but not an emergency absent exploitation signals - the missing EPSS/KEV/POC data means prioritization should be driven by exposure (is the Docker server reachable by untrusted callers and is it in a cloud/metadata-bearing environment) rather than by headline severity.

An attacker with network access to an exposed Crawl4AI Docker server submits a crawl targeting an attacker-controlled host while the robots.txt check path is active. Using an HTTP redirect or DNS rebinding, the server is coerced into fetching internal, loopback, or cloud-metadata addresses (e.g., 169.254.169.254), bypassing egress controls to enumerate internal services. No public POC was identified in the provided data, and because the SSRF is blind, the attacker infers reachability through timing/behavioral signals rather than direct response contents.