Crawl4AI EUVD-2026-104403

Exploitation requires (1) the Crawl4AI Docker API server (versions 0.8.7-0.9.5) to be network-reachable by the attacker, and (2) the request to set fetch_ssl_certificate=true, which triggers the vulnerable SSLCertificate.from_url path. The attacker must supply a URL whose userinfo component causes the destination/allowlist check to parse a different host than urlparse's netloc-based extraction used by the sink, so the connection resolves to an internal target. Limiting factors: the forced connection is only to TCP port 443 (pre-patch the port was hardcoded), and the disclosed data is restricted to TLS certificate metadata plus reachability inference - there is no arbitrary-port SSRF, no response body retrieval, and no write/integrity impact. No authentication or user interaction is required (PR:N/UI:N), but the fetch_ssl_certificate feature must be invokable in the target deployment.

This is a medium-severity SSRF (CWE-918) with a vendor-supplied CVSS 4.0 score of 6.9 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N), indicating a network-reachable, low-complexity, unauthenticated attack whose only confirmed impact is a LOW confidentiality leak with no integrity or availability impact. The signals are internally consistent and point to a genuine but bounded risk: an unauthenticated attacker can reach the flaw easily (AV:N/AC:L/PR:N/UI:N), but the payoff is limited to probing internal host reachability on port 443 and leaking TLS certificate metadata - not direct code execution or data exfiltration. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code was supplied; the GitHub PR and unit tests are remediation artifacts, not weaponized exploits, so this is 'no public exploit identified at time of analysis.' Net assessment: a legitimate priority for anyone exposing the Crawl4AI Docker API server to untrusted input (SSRF can pivot into internal network reconnaissance), but the low technical impact and absence of KEV/POC/EPSS signals place it below urgent-patch tier. Prioritize based on whether the Docker server is network-exposed. Note: the vendor supplied only a CVSS 4.0 vector - no CVSS 3.1 vector was provided in the input.

An attacker submits a crawl or certificate-fetch request to an exposed Crawl4AI Docker API server with fetch_ssl_certificate=true and a URL crafted with misleading userinfo (e.g. https://trusted@10.0.0.5/) that parses differently in the destination-check logic than in SSLCertificate.from_url. The server connects to the attacker-chosen internal host on port 443, and timing/success plus returned certificate details reveal which internal services exist and their TLS identities. No public exploit code was provided, though the fix and its regression tests are public.