AIL Framework CVE-2026-76164

Exploitation requires a valid low-privileged user account with access to the AIL Framework crawler interface, as confirmed by the CVSS 4.0 PR:L metric - unauthenticated attackers cannot exploit this vulnerability. The critical bypass condition is that manual crawler tasks are assigned a non-zero priority, which causes them to skip the existing domain blacklist; plain IP literals are additionally routed as web targets and fetched directly rather than via Tor. No special non-default configuration is required beyond having a user account with crawler access, since the crawler feature is part of the default AIL deployment. Exploitation is further constrained by the AIL server's actual network reachability to the targeted internal addresses - in air-gapped environments or deployments with strict egress filtering, the reachable internal attack surface is reduced. The non-blind response return (HTML, HAR, screenshots accessible via the crawler interface) is a default behavior, not a special configuration, meaning data exfiltration does not require any additional access beyond submitting the crawler task.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L) accurately reflects a network-accessible, low-complexity flaw requiring only low-privilege authentication, with high confidentiality impact on the vulnerable system. No EPSS data was included in the provided intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The non-blind nature of the SSRF - crawled responses including full HTML, HAR archives, and screenshots are returned through the crawler interface - substantially elevates real-world risk beyond a blind SSRF, because cloud-hosted AIL instances can have their IMDSv1 metadata endpoint queried and credentials directly exfiltrated without any additional tooling. The SC:L subsequent-system impact rating may understate risk for cloud deployments where retrieved IAM credentials enable lateral movement across AWS/GCP/Azure environments. The blacklist bypass is a deterministic logic flaw (priority-based routing), not a race condition or timing-dependent issue, meaning exploitation is reliable and repeatable for any user with crawler access - this elevates practical exploitability above what AC:L alone conveys. Defenders should not treat the low KEV/EPSS profile as a reason to deprioritize patching on internet-exposed or cloud-hosted AIL instances, where the credential exfiltration path is particularly high-value.

A low-privileged analyst account on an AIL instance hosted in AWS submits a manual crawler task targeting http://169.254.169.254/latest/meta-data/iam/security-credentials/ with a non-zero priority value, causing the task to bypass the domain blacklist and be fetched directly by the AIL server. The crawled response - containing the IAM role name and temporary credentials - is stored as a crawled item and retrieved by the attacker through the standard crawler results interface, yielding AWS access keys usable for lateral movement within the cloud account. No public exploit code has been identified; the attack requires only standard authenticated HTTP interactions with the AIL crawler API.