EUVD-2026-42880
GHSA-f23g-2f38-gg94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Crawl4AI Docker server
-
DeliverySubmit job with internal webhook URL
-
ExploitServer fetches 169.254.169.254 metadata
-
ExecutionCloud IAM credentials exposed
-
ImpactPivot to cloud resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run the Crawl4AI Docker API server and that its /crawl/job or /llm/job endpoints be network-reachable by the attacker; the attacker then supplies a webhook URL pointing at an internal or link-local destination such as 169.254.169.254. Per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) there is no authentication or user-interaction requirement, so on an exposed default deployment this is remote and unauthenticated. Realistic impact is limited by what the server can actually reach - a container with no cloud metadata service, with IMDSv2 enforced, or placed behind strict egress filtering sharply reduces the payoff even though the SSRF still triggers. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS artifact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H) indicates fully remote, unauthenticated, low-complexity exploitation with high confidentiality impact on both the vulnerable system and subsequent systems, consistent with SSRF reaching cloud metadata. The main tempering factors are exposure-related rather than technical: the attacker must be able to reach the Docker API server, and impact scales with the sensitivity of what is reachable internally (metadata credentials, internal admin panels). No EPSS score, KEV listing, or public POC was provided in the input, so widespread automated exploitation is not currently evidenced - the profile is high capability with unconfirmed real-world activity. Impact is confidentiality-focused (VI/VA:N); there is no direct integrity or availability damage from the SSRF itself, though harvested cloud credentials could enable follow-on compromise well beyond this CVE. |
| Exploit ScenarioDerived | An attacker who can reach an exposed Crawl4AI Docker API server submits a job to /crawl/job or /llm/job with the webhook URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/. On job completion the server POSTs to that URL, and if the response or error is observable, the attacker retrieves temporary cloud IAM credentials or maps internal services. No authentication or user interaction is required per the CVSS vector; no public exploit code was identified, but the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attackers to coerce the server into making arbitrary internal requests. The /crawl/job and /llm/job endpoints accept caller-supplied webhook URLs without validating the destination, so an attacker can target private IP ranges, Docker network internals, or the cloud metadata endpoint (169.254.169.254) to reach otherwise unreachable services and harvest credentials. CVSS 4.0 rates it 9.2 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade to Crawl4AI 0.8.7 or later, which adds destination validation for webhook URLs; see the advisory at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg. If immediate upgrade is not possible, apply compensating controls: restrict network access to the Docker API server so only trusted clients can submit jobs (the endpoints are unauthenticated by default); enforce egress filtering from the container to block outbound access to 169.254.169.254 and RFC1918/Docker-internal ranges, accepting that legitimate internal webhook targets would also be blocked; and where the cloud provider supports it, require IMDSv2 (session-token metadata) to blunt metadata theft even if the SSRF succeeds. If the /crawl/job and /llm/job webhook feature is not needed, disable or firewall those endpoints, noting this breaks asynchronous job callbacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Crawl4AI is an open-source, LLM-oriented web crawling and scraping framework commonly deployed as a containerized HTTP service (the 'Docker API server'). That server exposes asynchronous job endpoints (/crawl/job and /llm/job) that accept a webhook URL to which results are POSTed on completion. The root cause is CWE-918 (Server-Side Request Forgery): the webhook URL is treated as trusted output configuration and is fetched by the server with no allow-list, no destination validation, and no blocking of link-local, RFC1918, loopback, or Docker-internal address space. Because the container typically runs inside a cloud VM or an internal Docker/Kubernetes network, the server's network position lets a webhook request reach the instance metadata service (IMDSv1 at 169.254.169.254) or neighboring internal services that the external attacker could never contact directly.
Know when Crawl4ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Remote unauthenticated webhook abuse with no user interaction; SSRF reaches other systems so scope changes, high confidentiality from metadata exposure, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
Articles & Coverage 1
Executive ViewAI
Crawl4AI's Docker API server contains a critical server-side request forgery vulnerability (CVE-2026-56261, CVSS 9.2) exploitable by unauthenticated remote attackers, with no public exploit identified at time of analysis. The vulnerability allows attackers to coerce the API server into accessing internal services and cloud metadata endpoints, potentially exposing AWS credentials and enabling lateral movement within containerized infrastructure. Organizations running affected versions (prior to 0.8.7) face immediate risk of internal network compromise and credential theft if the API server is accessible from untrusted networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation restricting API server access to trusted networks via firewall/security group rules; (2) Deploy WAF or proxy to block outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and metadata endpoints (169.254.169.254); (3) Disable or restrict webhook URL functionality in vulnerable endpoints; (4) Implement egress filtering to prevent container-to-metadata service connections; (5) Restrict Docker daemon network access; (6) Monitor vendor security advisories for patch release. Target upgrade: Crawl4AI version 0.8.7 or later when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API client
Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into f
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overw
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attacker
Exploit-DB