Is CVE-2026-109237 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109237 being exploited in the wild.

How severe is CVE-2026-109237?

High severity, with a CVSS score of 8.1, published 12 October 2026.

Which products and versions are affected?

Unclecode Crawl4AI 0.9.0 through 0.9.3.

How is CVE-2026-109237 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109237?

Check whether you run Unclecode Crawl4AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109237: Crawl4AI untrusted-config gate bypass leaks environment variables

CVE-2026-109237 · Severity: high · CVSS 8.1 · Published 2026-10-12

Crawl4AI is a web scraping and crawling library used to extract content from websites. A security flaw allows unprivileged API clients to bypass configuration validation and read sensitive environment variables from the server, including API keys and secret keys needed for admin access. An attacker can forge administrative tokens to take over the system or steal credentials for third-party services like OpenAI or Anthropic.

Technologies: Unclecode Crawl4AI. Vendors: Unclecode.

Quick answers

Is CVE-2026-109237 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109237 being exploited in the wild.
How severe is CVE-2026-109237?: High severity, with a CVSS score of 8.1, published 12 October 2026.
Which products and versions are affected?: Unclecode Crawl4AI 0.9.0 through 0.9.3.
Is there a fix for CVE-2026-109237?: Yes: fixed in 0.9.4. Until then: Do not set SECRET_KEY in the server environment to prevent admin JWT forgery; avoid placing unnecessary secrets in the environment; restrict API access with an authenticating proxy. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109237 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109237?: Check whether you run Unclecode Crawl4AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.4

Do not set SECRET_KEY in the server environment to prevent admin JWT forgery; avoid placing unnecessary secrets in the environment; restrict API access with an authenticating proxy.

Technical details

The vulnerability is a deserialization bypass in async_configs.py where dict-wrapper objects {"type": "dict", "value": X} are recursively unwrapped without re-validating gated types, allowing forbidden objects like LLMConfig to be constructed with untrusted provenance. The from_kwargs methods default to TRUSTED provenance, causing the laundered config to be processed as trusted, allowing api_token="env:NAME" resolution via os.getenv(). This is reachable from /config/dump and other API endpoints accessible to non-admin clients, leaking arbitrary environment variables including SECRET_KEY for JWT forgery.

Affected products

unclecode Crawl4AI 0.9.0 through 0.9.3

Timeline

2026-09-23: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.