EUVD-2026-43226
GHSA-mw9f-q68p-364x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity access to exposed endpoints (AV:N/AC:L/PR:N/UI:N); high confidentiality from secret disclosure, limited integrity via leaked auth key, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass.
AnalysisAI
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attackers steal secrets from the host. By abusing the exposed /md, /llm, and /llm/job endpoints, an attacker supplies a malicious base_url to redirect outbound LLM API calls and sets api_token to the special form env:VARIABLE_NAME, causing the server to resolve and leak arbitrary environment variables - including provider API keys and the JWT SECRET_KEY, which in turn enables full authentication bypass. No public exploit identified at time of analysis, but the flaw is trivially exploitable and reported by VulnCheck with an assigned CVSS 4.0 score of 8.8.
Technical ContextAI
Crawl4AI is a popular open-source, LLM-oriented web-crawling and scraping framework that ships an optional Docker-based REST API server to expose crawling and LLM-extraction functionality over HTTP. The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Two design weaknesses combine: first, the LLM-integration endpoints accept a caller-controlled base_url, letting an attacker point the server's LLM client at an endpoint they control (an SSRF/redirection primitive); second, the api_token field supports an env:VARIABLE_NAME resolution syntax that dereferences server-side environment variables at request time. Because the framework transmits the resolved token to whatever base_url is supplied, an attacker who controls the destination receives the plaintext value of any environment variable they name. The single affected CPE is cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* (all versions prior to the fix).
RemediationAI
Vendor-released patch: upgrade Crawl4AI to 0.8.8 or later, which is the primary and definitive fix (see the vendor advisory GHSA-f989-c77f-r2cq at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f989-c77f-r2cq). If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks: bind it to localhost or a private segment and place it behind an authenticating reverse proxy or firewall so the /md, /llm, and /llm/job endpoints are unreachable by attackers - with the trade-off that any legitimate remote clients must be re-routed through the proxy. As additional hardening, run the container with a minimal environment that contains no secrets beyond what is strictly required (avoid placing JWT SECRET_KEY and provider API keys in the process environment), and after any suspected exposure rotate all provider API keys and the JWT SECRET_KEY, since a leaked signing key permits ongoing authentication bypass even after patching. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/crawl4ai-llm-credential-exfiltration-via-base-url-and-environment-variable-resolution) for detection guidance.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today