Which versions of Crawl4AI are affected by CVE-2026-56261?

Crawl4AI's Docker API server contains a critical server-side request forgery vulnerability (CVE-2026-56261, CVSS 9.2) exploitable by unauthenticated remote attackers, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-56261?

Within 24 hours: Identify all Crawl4AI deployments running versions before 0.8.7 and assess network exposure; immediately restrict API server access to trusted networks only using firewall and security group rules. Within 7 days: Implement network segmentation, deploy WAF or proxy rules to block outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254), and disable webhook functionality in /crawl/job and /llm/job endpoints if not critical. Within 30 days: Deploy Crawl4AI version 0.8.7 or later when vendor releases patch, rotate any cloud credentials that may have been exposed, audit cloud metadata service access logs, and verify patch deployment across all production instances.

Crawl4AI CVE-2026-56261

Q: What is the CVSS score of CVE-2026-56261?

CVE-2026-56261 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42880 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-10 VulnCheck

GHSA-f23g-2f38-gg94

Docker SSRF Crawl4ai

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote unauthenticated webhook abuse with no user interaction; SSRF reaches other systems so scope changes, high confidentiality from metadata exposure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:18 vuln.today

CVE Published

Jul 10, 2026 - 13:57 cve.org

CRITICAL 9.2

DescriptionCVE.org

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

Articles & Coverage 1

News Critical SSRF in Crawl4AI Docker API Server before 0.8.7 - CVE-2026-56261 Jul 11, 2026

AnalysisAI

Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attackers to coerce the server into making arbitrary internal requests. The /crawl/job and /llm/job endpoints accept caller-supplied webhook URLs without validating the destination, so an attacker can target private IP ranges, Docker network internals, or the cloud metadata endpoint (169.254.169.254) to reach otherwise unreachable services and harvest credentials. CVSS 4.0 rates it 9.2 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Crawl4AI is an open-source, LLM-oriented web crawling and scraping framework commonly deployed as a containerized HTTP service (the 'Docker API server'). That server exposes asynchronous job endpoints (/crawl/job and /llm/job) that accept a webhook URL to which results are POSTed on completion. The root cause is CWE-918 (Server-Side Request Forgery): the webhook URL is treated as trusted output configuration and is fetched by the server with no allow-list, no destination validation, and no blocking of link-local, RFC1918, loopback, or Docker-internal address space. Because the container typically runs inside a cloud VM or an internal Docker/Kubernetes network, the server's network position lets a webhook request reach the instance metadata service (IMDSv1 at 169.254.169.254) or neighboring internal services that the external attacker could never contact directly.

RemediationAI

Vendor-released patch: upgrade to Crawl4AI 0.8.7 or later, which adds destination validation for webhook URLs; see the advisory at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg. If immediate upgrade is not possible, apply compensating controls: restrict network access to the Docker API server so only trusted clients can submit jobs (the endpoints are unauthenticated by default); enforce egress filtering from the container to block outbound access to 169.254.169.254 and RFC1918/Docker-internal ranges, accepting that legitimate internal webhook targets would also be blocked; and where the cloud provider supports it, require IMDSv2 (session-token metadata) to blunt metadata theft even if the SSRF succeeds. If the /crawl/job and /llm/job webhook feature is not needed, disable or firewall those endpoints, noting this breaks asynchronous job callbacks.