Crawl4AI CVE-2026-56264

Exploitation requires that the Crawl4AI Docker API server be deployed and network-reachable by the attacker, and that the vulnerable /execute_js endpoint be exposed; the browser must be running with the --disable-web-security setting (the default for this server) for the SSRF pivot to succeed. Per CVSS PR:N no authentication is needed, but limiting factors are significant: the CVSS 4.0 vector rates this AC:H with a present attack requirement (AT:P), indicating non-trivial preconditions, and real exploitation depth depends on the server being internet- or network-exposed rather than bound to localhost, plus the existence of reachable internal services for the SSRF to target. Deployments that do not run the Docker API server, or that keep it on a trusted/localhost-only interface, are not practically exploitable.

Signals are mixed and worth weighing carefully. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) yields a critical 9.2 with no authentication required (PR:N) and high vulnerable-system impact, but it explicitly flags high attack complexity (AC:H) and a present attack requirement (AT:P), meaning successful exploitation depends on specific conditions rather than a single trivial request. Subsequent-system impact is rated none (SC:N/SI:N/SA:N), which sits in slight tension with the description's emphasis on SSRF into internal services - that internal reach is a real consequence even if the scoring does not credit a separate downstream system. No EPSS score and no KEV listing are provided, and there is no indication of a public proof-of-concept; the finding originates from VulnCheck with a coordinated GitHub Security Advisory (GHSA-365w-hqf6-vxfg). Net assessment: a genuine high-priority issue for anyone exposing the Crawl4AI Docker API server to untrusted networks, but the realistic risk hinges on whether that server is internet-exposed; in locked-down or localhost-only deployments the practical exposure is much lower than the 9.2 suggests.

An attacker who can reach an internet-exposed Crawl4AI Docker API server sends a crafted HTTP request to /execute_js containing JavaScript that issues fetches to internal endpoints (e.g., a cloud metadata service or an internal admin API). Because the browser runs with web security disabled, those cross-origin responses are readable, letting the attacker exfiltrate internal data or interact with services the server can reach. No authentication is required per the CVSS vector, though the high attack complexity suggests specific environmental conditions must align; no public proof-of-concept is currently identified.