Crawl4AI CVE-2026-56259

Exploitation requires that the Crawl4AI Docker API server (version before 0.8.8) be deployed and network-reachable by the attacker, with its unauthenticated /md, /llm, or /llm/job endpoints accessible. The concrete prerequisites are: the ability to send a request supplying a controlled base_url parameter, and use of the api_token=env:VARIABLE_NAME resolution feature to name the target environment variable. Sensitive values (provider API keys, JWT SECRET_KEY) must actually be present in the server's environment for the leak to yield useful secrets. Limiting factors: the vulnerability is only reachable if the Docker API server is exposed rather than bound to localhost or firewalled, so deployments that keep the server private are not remotely exploitable; per the CVSS vector no authentication or user interaction is required (PR:N/UI:N), so where the endpoints are exposed there are effectively no other barriers.

The signals are largely consistent and point to a genuine priority for anyone exposing the Crawl4AI Docker API. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, low-complexity, unauthenticated exploitation with no user interaction, and rates vulnerable-system confidentiality High (VC:H) with limited integrity impact (VI:L) - matching a credential-disclosure primitive. The base score of 8.8 (High) is credible. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified at time of analysis, so exploitation is currently theoretical-but-easy rather than confirmed in the wild. One nuance worth flagging: the vector rates integrity only Low, yet the description states the leaked JWT SECRET_KEY permits authentication bypass, which is effectively a higher integrity/scope consequence than VC:H/VI:L alone conveys - the real blast radius depends on what those stolen keys unlock (LLM provider billing abuse, downstream account takeover, or full API auth bypass). Overall this should be prioritized wherever the Docker server is network-reachable, tempered by the fact that exploitation requires the API server to actually be deployed and exposed.

An attacker discovers an internet-exposed Crawl4AI Docker API server and sends an unauthenticated POST to /llm with base_url pointing at their own listener and api_token set to env:OPENAI_API_KEY (then env:SECRET_KEY). The server dutifully resolves each environment variable and forwards it to the attacker's endpoint, handing over the LLM provider key and the JWT signing secret. Using the stolen SECRET_KEY, the attacker forges valid tokens to bypass authentication on the server. No public exploit was identified at time of analysis, but the attack requires only crafted HTTP requests and no authentication.