EUVD-2026-38745
GHSA-xrfj-6m49-wfmm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication (AV:N/PR:N/AC:L), no scope change, limited to monitoring state disruption with no confidentiality impact (C:N/I:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.
AnalysisAI
Authentication bypass in the Crawl4AI Docker API server before 0.8.7 exposes all monitor router endpoints - including the destructive /monitor/actions/cleanup action - to unauthenticated remote attackers due to missing token dependency injection on the monitor router. Any attacker with network access to the Docker API port can invoke cleanup operations and manipulate monitoring state, causing service disruption without credentials. No active exploitation (CISA KEV) or public POC has been identified at time of analysis; the CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:N/UI:N confirms trivial remote unauthenticated access with no special conditions required.
Technical ContextAI
Crawl4AI is a Python-based open-source web crawling and AI data extraction library that, when deployed via its optional Docker API server mode, exposes a FastAPI-based REST interface. The monitor router - responsible for crawl job monitoring and system cleanup operations - was registered in the FastAPI application without the token_dep dependency injection that enforces bearer token authentication on other API routes. The WebSocket /monitor/ws endpoint was similarly unprotected. The root cause is CWE-306 (Missing Authentication for Critical Function): the application's own authentication mechanism existed but was simply never wired to the monitor router. The affected CPE is cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* for all versions up to and including 0.8.6. This CVE is one of six vulnerabilities disclosed simultaneously in GHSA-365w-hqf6-vxfg, alongside higher-severity issues including arbitrary file write (CVSS 9.1), SSRF via webhook (CVSS 8.6), and a hardcoded JWT secret (CVSS 9.8) - all within the same Docker API server surface.
RemediationAI
Upgrade to Crawl4AI 0.8.7 or later via pip (pip install 'crawl4ai>=0.8.7'), which resolves this vulnerability by adding dependencies=[Depends(token_dep)] to the monitor router registration and adding explicit token validation on the /monitor/ws WebSocket endpoint. The fix and full disclosure are documented in GHSA-365w-hqf6-vxfg at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg. As a compensating control prior to patching, restrict network access to the Docker API server port using host firewall rules (iptables/ufw) or Docker network policies (--network=internal or explicit port binding to 127.0.0.1) to prevent external or lateral access to monitoring endpoints; note this is a network-level control only and does not fix the underlying authentication gap. Upgrading to 0.8.7 is strongly recommended as it also patches the five other vulnerabilities in the same advisory, including a hardcoded JWT secret (CVSS 9.8) that would undermine authentication across the entire API server if left unpatched.
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attack
Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into f
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overw
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today