CVE-2026-56259
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Crawl4AI before version 0.8.8 has a credential exfiltration vulnerability via unauthenticated Docker API endpoints. Attackers can redirect LLM API calls to attacker-controlled servers and read environment variables, including API keys and JWT secrets.
Risk Assessment
The risk includes theft of LLM provider API keys and JWT secrets, potentially leading to unauthorized system access and privilege escalation within the organization.
Recommendation
Immediately update Crawl4AI to version 0.8.8 or later, and restrict access to API endpoints using authentication and firewall rules.
Other vulnerabilities in Crawl4AI
See all- CVE-2026-56260Critical
Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.
- CVE-2026-57572Critical
Crawl4AI before version 0.9.0 has a vulnerability in the Docker API that allows injecting arguments into the Chromium browser. An attacker can use Chromium switches to replace the child process launch command, leading to arbitrary code execution in the container.
- CVE-2026-57571Critical
In Crawl4AI before version 0.9.0, a vulnerability allows arbitrary file write due to insufficient path confinement. An attacker can control the destination filename via Content-Disposition header or suggested filename, leading to file write outside the downloads directory. This can escalate to remote code execution.
- CVE-2026-53753Critical
Crawl4AI before version 0.8.7 has a vulnerability in the _safe_eval_expression() function in the computed fields feature. The AST validator only blocks attributes starting with underscore, but generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.
- CVE-2026-26216Critical
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands.
- CVE-2026-56261High
Crawl4AI before version 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
- CVE-2026-57573High
Crawl4AI before version 0.9.0 has an SSRF vulnerability in the Docker API streaming path. An unauthenticated remote client can send a POST request to /crawl/stream or /crawl with stream=true, pointing to an internal, private, or link-local address, and the server fetches and streams the response.
- CVE-2026-56264High
Crawl4AI before version 0.8.7 contains an arbitrary JavaScript execution vulnerability in the /execute_js endpoint of the Docker API server. An attacker can submit malicious scripts that execute in the server's browser context with disabled web security.
- CVE-2026-53755High
Crawl4AI prior to version 0.8.9 contains an SSRF vulnerability that allows an unauthenticated attacker to bypass the destination URL check and route traffic through a proxy to internal IP addresses. The attacker can exploit this flaw to access internal services and cloud metadata endpoints while providing a valid crawl URL.
- CVE-2026-53754High
Crawl4AI before version 0.8.8 has an SSRF vulnerability in the Docker API server that allows an attacker to bypass the CIDR blocklist and access internal services and cloud metadata endpoints (e.g., 169.254.169.254) by encoding an IPv4 address in an IPv6 transition form or using the IPv6 unspecified address. Since the Docker API is unauthenticated by default, no credentials are required for the attack.
Original NVD description (English source)
Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass.