Skip to main content

Crawl4AI CVE-2026-56261

| EUVDEUVD-2026-42880 CRITICAL
Server-Side Request Forgery (SSRF) (CWE-918)
2026-07-10 VulnCheck GHSA-f23g-2f38-gg94
SSRF Docker Crawl4ai
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.6 HIGH

Remote unauthenticated webhook abuse with no user interaction; SSRF reaches other systems so scope changes, high confidentiality from metadata exposure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 10, 2026 - 16:16 EUVD
Analysis Generated
Jul 10, 2026 - 15:18 vuln.today
CVE Published
Jul 10, 2026 - 13:57 cve.org
CRITICAL 9.2

DescriptionCVE.org

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

Articles & Coverage 1

News Critical SSRF in Crawl4AI Docker API Server before 0.8.7 - CVE-2026-56261 Jul 11, 2026

AnalysisAI

Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attackers to coerce the server into making arbitrary internal requests. The /crawl/job and /llm/job endpoints accept caller-supplied webhook URLs without validating the destination, so an attacker can target private IP ranges, Docker network internals, or the cloud metadata endpoint (169.254.169.254) to reach otherwise unreachable services and harvest credentials. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed Crawl4AI Docker server
Delivery
Submit job with internal webhook URL
Exploit
Server fetches 169.254.169.254 metadata
Execution
Cloud IAM credentials exposed
Impact
Pivot to cloud resources
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target run the Crawl4AI Docker API server and that its /crawl/job or /llm/job endpoints be network-reachable by the attacker; the attacker then supplies a webhook URL pointing at an internal or link-local destination such as 169.254.169.254. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue, not merely a high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach an exposed Crawl4AI Docker API server submits a job to /crawl/job or /llm/job with the webhook URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/. On job completion the server POSTs to that URL, and if the response or error is observable, the attacker retrieves temporary cloud IAM credentials or maps internal services. …
Remediation Vendor-released patch: upgrade to Crawl4AI 0.8.7 or later, which adds destination validation for webhook URLs; see the advisory at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Crawl4AI deployments running versions before 0.8.7 and assess network exposure; immediately restrict API server access to trusted networks only using firewall and security group rules. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Docker

View all
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2019-5736 HIGH POC
8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
CVE-2023-32077 HIGH POC
7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2023-5815 HIGH POC
8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
CVE-2014-9357 CRITICAL
10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
CVE-2026-34156 CRITICAL POC
9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
CVE-2019-15752 HIGH POC
7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
CVE-2025-34221 CRITICAL POC
10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
CVE-2024-23054 CRITICAL POC
9.8 Feb 05

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
CVE-2025-23211 CRITICAL POC
9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
CVE-2026-46339 CRITICAL POC
10.0 May 19

Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2023-48022 CRITICAL POC
9.8
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2026-56261 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy