Crawl4AI EUVD-2026-38170

Requires network reach to a Crawl4AI Docker API server running a version <= 0.8.6 where the operator did NOT override the default JWT signing key 'mysecret' at deployment time - the CVSS PR:N rating reflects that no prior credentials are needed, only knowledge of the public default. The primary limiting factor is operator configuration: deployments that supplied a custom signing key via the documented environment variable are not exploitable through this path, and instances bound only to localhost or an internal network are not reachable from the public internet. No user interaction, no special platform, and no non-default feature toggle is required beyond running the Docker API server itself.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (9.3) is consistent with the description - exploitation needs only network reach to the exposed Docker API and forging a token with the known default secret, with full confidentiality, integrity and availability impact on the vulnerable system. Status is 'no public exploit identified at time of analysis' (no KEV listing, no POC referenced in the provided sources), but a working exploit is essentially a five-line jwt.encode() call, so the practical barrier to exploitation is minimal once an exposed instance is found. EPSS and SSVC data were not supplied, so probabilistic exploitation scoring cannot be cross-checked; however, given (a) VulnCheck attribution, (b) the trivial nature of the bug, and (c) Crawl4AI's typical deployment as an internet-facing scraping service, real-world risk should be treated as high for any operator who did not explicitly override the JWT secret. The main limiter is operational: deployments that already replaced the default key during initial setup are not exploitable via this path.

An attacker enumerates internet-exposed Crawl4AI Docker API servers (e.g., via Shodan banner matching on the FastAPI service), then locally runs jwt.encode({'sub':'admin'}, 'mysecret', algorithm='HS256') to forge a bearer token for an arbitrary user. They submit the token to protected endpoints and obtain full crawl, extraction, JavaScript execution, and configuration access - which can be chained with the co-fixed /execute_js and SSRF issues to pivot into internal networks or cloud metadata.