EUVD-2026-38366
GHSA-365w-hqf6-vxfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Crawl4AI endpoint
-
DeliveryPOST /crawl with ::ffff:169.254.169.254 URL
-
ExploitBypass IPv4 blocklist via IPv6-mapped form
-
ExecutionServer fetches cloud metadata
-
PersistExfiltrate IAM credentials in response
-
ImpactPivot into cloud account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Crawl4AI Docker API server must be reachable by the attacker on one of /crawl, /crawl/stream, /md, or /llm; per CVSS PR:N/UI:N no authentication or user interaction is required, matching the description's 'unauthenticated attackers'. Impact is maximized when the server runs in a cloud environment with an accessible instance-metadata service (169.254.169.254) or alongside other reachable internal services; deployments with strict egress filtering, IMDSv2-with-hop-limit-1, or a network position with no internal targets reduce real-world impact even though the SSRF itself still triggers. Affected versions are <= 0.8.6; instances on 0.8.7+ are not exploitable via this bypass. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 9.2) is internally consistent with the description: network-reachable, no authentication, no user interaction, and high confidentiality impact on both the vulnerable system and a subsequent system (cloud metadata / internal services). The realistic risk is elevated because Crawl4AI is frequently deployed inside cloud environments (AWS, GCP, Azure) where 169.254.169.254 returns instance credentials - a successful SSRF here can directly yield IAM tokens and pivot beyond the host. There is no KEV listing and no public PoC referenced in the supplied data, and EPSS was not provided, so widespread opportunistic exploitation is not yet evidenced; however, the bypass technique (IPv6-mapped IPv4) is trivial and well-known, and the affected endpoints are unauthenticated by default, so exposure of any internet-facing Crawl4AI Docker instance should be treated as immediately actionable. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed Crawl4AI Docker instance on AWS and POSTs to /crawl with url=http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/, bypassing the blocklist via the IPv6-mapped form. The response body - relayed back through the crawler - contains the EC2 instance's IAM role temporary credentials, which the attacker then uses to access S3 buckets and other AWS resources. No public PoC is referenced in the supplied data, but the technique is well-documented and the attack requires only a single unauthenticated HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into fetching arbitrary internal URLs via the /crawl, /crawl/stream, /md, and /llm endpoints. The product's internal-address blocklist can be bypassed using IPv6-mapped IPv4 notation (e.g., ::ffff:169.254.169.254), exposing cloud metadata services and internal infrastructure. No public exploit identified at time of analysis, but the GHSA advisory and a VulnCheck write-up document the flaw in detail.
RemediationAI
Upgrade Crawl4AI to 0.8.7 or later (pip install --upgrade crawl4ai, or pull the corresponding patched Docker image), which extends the SSRF validator to normalize IPv6-mapped IPv4 addresses and explicitly blocks RFC 1918, loopback, link-local, and cloud-metadata destinations, per GHSA-365w-hqf6-vxfg. If immediate patching is not possible, place the Crawl4AI server behind an authenticated reverse proxy and restrict outbound egress from the container so it cannot reach 169.254.169.254, RFC 1918 ranges, fd00::/8, or other internal hosts (a strict egress firewall is the most effective compensating control, though it will break legitimate intranet crawling use cases); additionally, on cloud providers enforce IMDSv2 with a hop limit of 1 on AWS, or equivalent metadata-protection controls on GCP/Azure, to neutralize the most damaging SSRF payload. Note that the same release also fixes related issues (arbitrary file write, webhook SSRF, monitor auth bypass, hardcoded JWT secret of 'mysecret'), so partial mitigations against this single CVE leave significant residual risk - the upgrade is strongly preferred.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Crawl4AI is an open-source LLM-friendly web crawler distributed as a Python package (pip/crawl4ai) and Docker API server, commonly embedded in AI/LLM data-ingestion pipelines. The affected endpoints accept user-supplied URLs and pass them to the crawler's HTTP fetcher; the existing safeguard relied on a string/IP blocklist that did not normalize IPv6-mapped IPv4 representations (RFC 4291 ::ffff:0:0/96), so addresses such as ::ffff:169.254.169.254 or ::ffff:10.0.0.1 dereferenced to the same internal targets while evading the filter. This is a textbook CWE-918 (Server-Side Request Forgery) caused by parser/normalizer mismatch between the validator and the underlying socket resolver, and it sits alongside several other Docker-API issues disclosed in GHSA-365w-hqf6-vxfg (arbitrary file write, webhook SSRF, monitor auth bypass, stored XSS, JS execution, hardcoded JWT secret).
Know when Crawl4ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Unauthenticated network request to default endpoints triggers SSRF; scope changes to reach metadata/internal services (S:C, C:H); no integrity or availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
Executive ViewAI
Crawl4AI before version 0.8.7 contains a critical, unauthenticated server-side request forgery (SSRF) vulnerability allowing remote attackers to access internal infrastructure and cloud metadata services without credentials. Organizations using Crawl4AI face immediate risk to cloud credentials, internal systems, and sensitive metadata if the application is internet-accessible or deployed in untrusted network segments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict Crawl4AI outbound network access to explicitly authorized external domains only; (2) deploy WAF rules to block requests containing IPv6-mapped IPv4 notation (::ffff:/); (3) disable /crawl, /crawl/stream, /md, and /llm endpoints if operationally unnecessary; (4) isolate Crawl4AI instances from internet-facing networks and untrusted network segments using network segmentation until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attack
Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API client
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overw
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attacker
Exploit-DB