What is the CVSS score of CVE-2026-53755?

CVE-2026-53755 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Crawl4AI are affected by CVE-2026-53755?

Crawl4AI Docker API server (versions before 0.8.9) contains an unauthenticated server-side request forgery (SSRF) vulnerability allowing remote attackers to access internal services and…. A patch is available.

How to fix or mitigate CVE-2026-53755?

Within 24 hours: Identify all systems running Crawl4AI versions < 0.8.9. Within 7 days: Deploy Crawl4AI version 0.8.9 or later across all affected deployments; prioritize internet-accessible instances. Within 30 days: Verify patch deployment completion, review access logs for exploitation attempts targeting internal IP ranges (particularly 169.254.169.254), and audit any exposed credentials.

Crawl4AI CVE-2026-53755

EUVD-2026-38567 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-16 https://github.com/unclecode/crawl4ai

GHSA-6qhc-x826-342c

Google SSRF Docker

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Default-unauthenticated network API (PR:N, AV:N, AC:L) yields read-only SSRF exposing internal/metadata data (C:H) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 16:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 16:52 vuln.today

cvss_changed

CVSS changed

Jun 29, 2026 - 16:52 NVD

8.6 (HIGH) 7.5 (HIGH)

Source Code Evidence Fetched

Jun 16, 2026 - 23:19 vuln.today

Analysis Generated

Jun 16, 2026 - 23:19 vuln.today

CVE Published

Jun 16, 2026 - 21:02 github-advisory

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on crawl4ai (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.8.9.

DescriptionNVD

Summary

The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.

Affected paths

/crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked:

browser_config.proxy_config.server
browser_config.proxy (deprecated field)
crawler_config.proxy_config.server
--proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser_config.extra_args

Attack

An attacker sends /crawl with a benign, validation-passing URL but a proxy_config.server pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (results[0].html / cleaned_html / markdown). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.

Impact

Unauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.

Fix

Every proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not is_global, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from extra_args. A legitimate public proxy still works. Honors CRAWL4AI_ALLOW_INTERNAL_URLS.

Workarounds

Upgrade to the patched version (0.8.9).
Enable authentication (CRAWL4AI_API_TOKEN).
Restrict the container's outbound network access (egress firewall / no metadata route).

Credits

Geo (geo-chen) - reported the proxy_config.server SSRF with a clear PoC.

Articles & Coverage 1

News 5 New Docker Vulnerabilities - 1 Critical, 4 High Severity Jun 17, 2026

AnalysisAI

Unauthenticated server-side request forgery in Crawl4AI's Docker API server (versions < 0.8.9) lets remote attackers reach internal services and cloud-metadata endpoints by supplying a proxy address that bypasses the crawl-URL validation. Because the Docker API is unauthenticated by default and the SSRF check was only applied to the crawl target - not to the proxy destination - an attacker can route Chromium's egress through an internal IP (e.g. AWS IMDSv1 at 169.254.169.254) and read the response verbatim from the crawl result. No public exploit is identified at time of analysis, but the reporter supplied a working PoC and EPSS risk is low (0.29%, 20th percentile).

Technical ContextAI

Crawl4AI is a Python (pip) web-crawling/scraping framework that drives a headless Chromium browser, commonly deployed as a containerized Docker API service feeding LLM/RAG pipelines. The root cause is CWE-918 (Server-Side Request Forgery): the global-routability (is_global) destination check was enforced on the user-supplied crawl URL but not on the separate proxy configuration. Multiple inputs feed Chromium's egress and were unchecked - browser_config.proxy_config.server, the deprecated browser_config.proxy field, crawler_config.proxy_config.server, and the Chromium --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags passed via browser_config.extra_args. By pointing the proxy at an internal address while keeping a benign, validation-passing crawl URL, the browser's traffic is tunneled to attacker-chosen internal endpoints. The affected package is identified by CPE pkg:pip/crawl4ai.

RemediationAI

Vendor-released patch: upgrade to Crawl4AI 0.8.9, which validates every proxy destination with the same global-routability (is_global) check used for crawl URLs - rejecting non-global resolved addresses including IPv6 transition forms - and strips proxy/DNS-redirecting flags (--proxy-server, --proxy-pac-url, --proxy-bypass-list, --host-resolver-rules) from extra_args, while still honoring CRAWL4AI_ALLOW_INTERNAL_URLS for legitimate internal use. If immediate upgrade is not possible, enable authentication by setting CRAWL4AI_API_TOKEN so the Docker API is no longer unauthenticated (trade-off: all API clients must now present the token). Additionally, restrict the container's outbound network access with an egress firewall and remove the cloud-metadata route (e.g. block 169.254.169.254), which prevents the metadata-credential theft scenario but may break legitimate crawls that rely on those destinations. Advisory: https://github.com/unclecode/crawl4ai/security/advisories/GHSA-6qhc-x826-342c.