Crawl4AI SSRF in Docker server streaming crawl path

Executive brief

Crawl4AI is a tool used to crawl and extract data from websites. A security flaw in its Docker API allows unauthenticated users to force the server to access internal network resources, such as private services or cloud metadata containing sensitive credentials. This could lead to the exposure of internal company data or administrative access to cloud environments.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Crawl4AI Docker API server due to missing destination validation in the streaming crawl path. While the standard `/crawl` endpoint implemented `validate_url_destination`, the `handle_stream_crawl_request` function used by `/crawl/stream` (and `/crawl` with `stream=true`) failed to perform these checks. An unauthenticated remote attacker can provide URLs pointing to internal, private, or link-local addresses (e.g., 169.254.169.254). The server will fetch the content from these restricted locations and stream the response body back to the attacker. This issue is fixed in version 0.9.0 by applying global-routability checks to all seed URLs in the streaming handler.

Affected products

• unclecode crawl4ai <= 0.8.9

Timeline

• 2026-06-18: advisory: GitHub Advisory GHSA-wm69-2pc3-rmmf published
• 2026-06-18: patched: Version 0.9.0 released

References

• https://api.github.com/users/seankohjs
• https://github.com/seankohjs
• https://api.github.com/users/seankohjs/gists%7B/gist_id%7D
• https://api.github.com/users/seankohjs/repos
• https://avatars.githubusercontent.com/u/145921214?v=4
• https://api.github.com/users/seankohjs/events%7B/privacy%7D