Which versions of Crawl4AI are affected by CVE-2026-26217?

Crawl4AI Docker API versions before 0.8.0 allow unauthenticated remote attackers to read arbitrary files on the server, directly exposing credentials, API keys, and application configuration.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26217?

Yes, a public proof-of-concept exploit is available for CVE-2026-26217. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26217?

Within 24 hours, identify all Crawl4AI deployments and confirm which are running versions before 0.8.0; isolate or disable affected instances if they are internet-facing. Within 7 days, upgrade all instances to Crawl4AI 0.8.0 or later and immediately rotate all credentials, API keys, and secrets that may have been stored in /etc/ directories or environment variables. Within 30 days, review access logs for exploitation attempts, conduct a secrets rotation audit, and implement network segmentation to restrict API endpoint access to authorized networks only.

Crawl4AI CVE-2026-26217

Q: What is the CVSS score of CVE-2026-26217?

CVE-2026-26217 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

Path Traversal (CWE-22)

2026-02-12 disclosure@vulncheck.com

GHSA-vx9w-5cx4-9796

Docker Path Traversal Crawl4ai Kidocode

9.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network file read (AV:N/AC:L/PR:N/UI:N); reading OS files beyond the app's authority is a scope change (S:C) with high confidentiality but no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 16:38 vuln.today

Analysis Updated

Jul 14, 2026 - 16:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 16:22 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 16:22 NVD

8.6 (HIGH) 9.2 (CRITICAL)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 16:16 nvd

HIGH 8.6

DescriptionCVE.org

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

AnalysisAI

Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers read any file on the server by supplying file:// URLs to the /execute_js, /screenshot, /pdf, and /html endpoints. Because the API validates no scheme, an attacker can exfiltrate /etc/passwd, /etc/shadow, application config, and process environment via /proc/self/environ - directly exposing credentials and API keys. Publicly documented in GitHub advisory GHSA-vx9w-5cx4-9796 with a working request example; no public exploit identified as active exploitation, and EPSS is low (0.06%, 19th percentile).

Technical ContextAI

Crawl4AI is an open-source LLM-oriented web crawler/scraper (Python package pip/crawl4ai, CPE cpe:2.3:a:kidocode:crawl4ai) that ships a Dockerized HTTP API for headless browsing and rendering. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) manifesting as classic Local File Inclusion / SSRF-to-file-read: the URL parameter accepted by the rendering endpoints is passed to the underlying browser fetch layer without restricting the URI scheme, so file:// (and pseudo-files like /proc/self/environ) resolve against the container filesystem instead of being limited to http/https remote targets. The root cause is missing scheme allow-listing on user-supplied fetch targets.

RemediationAI

Vendor-released patch: upgrade Crawl4AI to 0.8.0 or later, which fixes the file:// handling per GHSA-vx9w-5cx4-9796 and the v0.8.0 release notes. If immediate upgrade is not possible, apply the vendor's documented workarounds: disable the Docker API entirely where it is not required (removes the exposure but breaks any programmatic rendering integrations); place authentication in front of the API (mitigates unauthenticated abuse but does not stop an authenticated insider or a leaked token); and enforce network-level filtering so the API port is reachable only from trusted hosts (reduces internet exposure but does not address same-network attackers). Where the API must stay reachable, additionally block or reject requests whose url parameter uses the file:// scheme or references /proc paths at a proxy layer, accepting that this is a fragile stopgap versus the 0.8.0 fix.