What is the CVSS score of CVE-2026-57573?

CVE-2026-57573 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Crawl4AI are affected by CVE-2026-57573?

Crawl4AI Docker API server versions prior to 0.9.0 allow unauthenticated remote attackers to bypass the security allowlist and force the service to access internal, private, and link-local network…. A patch is available.

How to fix or mitigate CVE-2026-57573?

Within 24 hours: Identify all systems running Crawl4AI versions prior to 0.9.0; implement network isolation restricting outbound connectivity to only necessary destinations; review access logs for POST /crawl/stream or POST /crawl requests with stream=true parameters. Within 7 days: Deploy network segmentation rules blocking requests to RFC 1918 address ranges and link-local addresses; disable the streaming endpoint if not operationally required. Within 30 days: Establish vendor monitoring for patch release; develop migration strategy to alternative web crawling solutions if patch availability extends beyond organizational risk tolerance.

Crawl4AI CVE-2026-57573

EUVD-2026-41935 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-06 GitHub_M

Docker SSRF Crawl4ai Unclecode

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) that pivots to other systems justifies S:C with C:H for exposed internal data; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:14 vuln.today

CVE Published

Jul 06, 2026 - 20:11 cve.org

HIGH 8.6

DescriptionCVE.org

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.

Articles & Coverage 1

News 5 New Docker Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 07, 2026

AnalysisAI

Server-side request forgery in Crawl4AI's Docker API server (versions prior to 0.9.0) lets a remote unauthenticated client coerce the server into fetching attacker-chosen internal, private, or link-local URLs and streaming the response body back. The SSRF destination allowlist check was enforced on the non-streaming /crawl path but omitted from the streaming code path, so requests to POST /crawl/stream - or POST /crawl with crawler_config.stream=true - bypass validation entirely. No public exploit identified at time of analysis, but the fix is public in commit 60886d1 and the root cause (a guard applied to one path but not its sibling) is trivial to reproduce.

Technical ContextAI

Crawl4AI is an open-source, LLM-oriented web crawler and scraper commonly deployed as a self-hosted Docker API server that accepts seed URLs and returns fetched/extracted page content. The affected component is the request handler layer: the codebase already implemented an SSRF destination check to reject internal/private targets, but handle_stream_crawl_request forwarded seed URLs directly to the crawler engine without invoking that validation. This is a textbook CWE-918 (Server-Side Request Forgery) defect of the 'inconsistent enforcement' variety - the security control exists but is not uniformly applied across all entry points. The single affected product per CPE is cpe:2.3:a:unclecode:crawl4ai:*, all versions below 0.9.0.

RemediationAI

Upgrade to Crawl4AI 0.9.0, which adds the missing SSRF destination validation to the streaming path (Vendor-released patch: 0.9.0; upstream fix commit 60886d1a0c52682e4c83a7cef9dfac417fff6bd2). If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks: bind it to localhost or place it behind an authenticating reverse proxy and network ACLs, and use egress firewall rules or a forward proxy to block the server from reaching RFC1918 ranges, link-local 169.254.0.0/16 (including cloud metadata endpoints such as 169.254.169.254), and loopback - accepting that this also blocks any legitimate internal crawling. As a stopgap you can disable or block the POST /crawl/stream endpoint and reject requests carrying crawler_config.stream=true at the proxy, at the cost of losing streaming functionality. Refer to https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf.