Is there a patch available for CVE-2026-56259?

Yes, a patch is available for CVE-2026-56259. Update the affected software to the latest version immediately.

Crawl4AI CVE-2026-56259

Q: What is the CVSS score of CVE-2026-56259?

CVE-2026-56259 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43226 HIGH

Information Exposure (CWE-200)

2026-07-12 VulnCheck

GHSA-mw9f-q68p-364x

Authentication Bypass Information Disclosure Docker Crawl4ai

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Remote, unauthenticated, low-complexity access to exposed endpoints (AV:N/AC:L/PR:N/UI:N); high confidentiality from secret disclosure, limited integrity via leaked auth key, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 12, 2026 - 13:01 EUVD

CVE Published

Jul 12, 2026 - 12:48 cve.org

HIGH 8.8

Analysis Generated

Jul 12, 2026 - 12:36 vuln.today

DescriptionCVE.org

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass.

AnalysisAI

Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attackers steal secrets from the host. By abusing the exposed /md, /llm, and /llm/job endpoints, an attacker supplies a malicious base_url to redirect outbound LLM API calls and sets api_token to the special form env:VARIABLE_NAME, causing the server to resolve and leak arbitrary environment variables - including provider API keys and the JWT SECRET_KEY, which in turn enables full authentication bypass. No public exploit identified at time of analysis, but the flaw is trivially exploitable and reported by VulnCheck with an assigned CVSS 4.0 score of 8.8.

Technical ContextAI

Crawl4AI is a popular open-source, LLM-oriented web-crawling and scraping framework that ships an optional Docker-based REST API server to expose crawling and LLM-extraction functionality over HTTP. The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Two design weaknesses combine: first, the LLM-integration endpoints accept a caller-controlled base_url, letting an attacker point the server's LLM client at an endpoint they control (an SSRF/redirection primitive); second, the api_token field supports an env:VARIABLE_NAME resolution syntax that dereferences server-side environment variables at request time. Because the framework transmits the resolved token to whatever base_url is supplied, an attacker who controls the destination receives the plaintext value of any environment variable they name. The single affected CPE is cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* (all versions prior to the fix).

RemediationAI

Vendor-released patch: upgrade Crawl4AI to 0.8.8 or later, which is the primary and definitive fix (see the vendor advisory GHSA-f989-c77f-r2cq at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f989-c77f-r2cq). If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks: bind it to localhost or a private segment and place it behind an authenticating reverse proxy or firewall so the /md, /llm, and /llm/job endpoints are unreachable by attackers - with the trade-off that any legitimate remote clients must be re-routed through the proxy. As additional hardening, run the container with a minimal environment that contains no secrets beyond what is strictly required (avoid placing JWT SECRET_KEY and provider API keys in the process environment), and after any suspected exposure rotate all provider API keys and the JWT SECRET_KEY, since a leaked signing key permits ongoing authentication bypass even after patching. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/crawl4ai-llm-credential-exfiltration-via-base-url-and-environment-variable-resolution) for detection guidance.