Which versions of Crawl4AI are affected by CVE-2026-56266?

Crawl4AI before version 0.8.7 contains a critical, unauthenticated server-side request forgery (SSRF) vulnerability allowing remote attackers to access internal infrastructure and cloud metadata…. A patch is available.

How to fix or mitigate CVE-2026-56266?

Within 24 hours: Identify all Crawl4AI deployments, document internet accessibility, and assess whether instances can reach cloud metadata services or internal infrastructure. Within 7 days: Request patch status and timeline directly from Crawl4AI maintainers; implement interim network controls (segmentation, WAF rules blocking IPv6-mapped IPv4 notation including ::ffff:169.254.169.254) if Crawl4AI is production-critical. Within 30 days: Deploy Crawl4AI version 0.8.7 or later once released; validate that IPv6-mapped IPv4 bypass is closed and test in non-production before production rollout.

Crawl4AI CVE-2026-56266

Q: What is the CVSS score of CVE-2026-56266?

CVE-2026-56266 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38366 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-22 VulnCheck

GHSA-365w-hqf6-vxfg

SSRF Crawl4ai

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network request to default endpoints triggers SSRF; scope changes to reach metadata/internal services (S:C, C:H); no integrity or availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 22:17 vuln.today

Analysis Generated

Jun 22, 2026 - 22:17 vuln.today

DescriptionCVE.org

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.

AnalysisAI

Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into fetching arbitrary internal URLs via the /crawl, /crawl/stream, /md, and /llm endpoints. The product's internal-address blocklist can be bypassed using IPv6-mapped IPv4 notation (e.g., ::ffff:169.254.169.254), exposing cloud metadata services and internal infrastructure. No public exploit identified at time of analysis, but the GHSA advisory and a VulnCheck write-up document the flaw in detail.

Technical ContextAI

Crawl4AI is an open-source LLM-friendly web crawler distributed as a Python package (pip/crawl4ai) and Docker API server, commonly embedded in AI/LLM data-ingestion pipelines. The affected endpoints accept user-supplied URLs and pass them to the crawler's HTTP fetcher; the existing safeguard relied on a string/IP blocklist that did not normalize IPv6-mapped IPv4 representations (RFC 4291 ::ffff:0:0/96), so addresses such as ::ffff:169.254.169.254 or ::ffff:10.0.0.1 dereferenced to the same internal targets while evading the filter. This is a textbook CWE-918 (Server-Side Request Forgery) caused by parser/normalizer mismatch between the validator and the underlying socket resolver, and it sits alongside several other Docker-API issues disclosed in GHSA-365w-hqf6-vxfg (arbitrary file write, webhook SSRF, monitor auth bypass, stored XSS, JS execution, hardcoded JWT secret).

RemediationAI

Upgrade Crawl4AI to 0.8.7 or later (pip install --upgrade crawl4ai, or pull the corresponding patched Docker image), which extends the SSRF validator to normalize IPv6-mapped IPv4 addresses and explicitly blocks RFC 1918, loopback, link-local, and cloud-metadata destinations, per GHSA-365w-hqf6-vxfg. If immediate patching is not possible, place the Crawl4AI server behind an authenticated reverse proxy and restrict outbound egress from the container so it cannot reach 169.254.169.254, RFC 1918 ranges, fd00::/8, or other internal hosts (a strict egress firewall is the most effective compensating control, though it will break legitimate intranet crawling use cases); additionally, on cloud providers enforce IMDSv2 with a hop limit of 1 on AWS, or equivalent metadata-protection controls on GCP/Azure, to neutralize the most damaging SSRF payload. Note that the same release also fixes related issues (arbitrary file write, webhook SSRF, monitor auth bypass, hardcoded JWT secret of 'mysecret'), so partial mitigations against this single CVE leave significant residual risk - the upgrade is strongly preferred.