# CVE-2026-109237: Crawl4AI untrusted-config gate bypass leaks environment variables

Source: https://junglewise.ai/threats/cve-2026-109237-crawl4ai-from-0-9-0-before-0-9-4-contains-an-untrusted-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109237 · Severity: high · CVSS 8.1 · Published 2026-10-12

Crawl4AI is a web scraping and crawling library used to extract content from websites. A security flaw allows unprivileged API clients to bypass configuration validation and read sensitive environment variables from the server, including API keys and secret keys needed for admin access. An attacker can forge administrative tokens to take over the system or steal credentials for third-party services like OpenAI or Anthropic.

Technologies: [Unclecode Crawl4AI](https://junglewise.ai/threats/technologies/unclecode-crawl4ai). Vendors: [Unclecode](https://junglewise.ai/threats/vendors/unclecode).

## Quick answers

**Is CVE-2026-109237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109237 being exploited in the wild.

**How severe is CVE-2026-109237?** High severity, with a CVSS score of 8.1, published 12 October 2026.

**Which products and versions are affected?** Unclecode Crawl4AI 0.9.0 through 0.9.3.

**Is there a fix for CVE-2026-109237?** Yes: fixed in 0.9.4. Until then: Do not set SECRET_KEY in the server environment to prevent admin JWT forgery; avoid placing unnecessary secrets in the environment; restrict API access with an authenticating proxy. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109237 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109237?** Check whether you run Unclecode Crawl4AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.4

Do not set SECRET_KEY in the server environment to prevent admin JWT forgery; avoid placing unnecessary secrets in the environment; restrict API access with an authenticating proxy.

## Technical details

The vulnerability is a deserialization bypass in async_configs.py where dict-wrapper objects {"type": "dict", "value": X} are recursively unwrapped without re-validating gated types, allowing forbidden objects like LLMConfig to be constructed with untrusted provenance. The from_kwargs methods default to TRUSTED provenance, causing the laundered config to be processed as trusted, allowing api_token="env:NAME" resolution via os.getenv(). This is reachable from /config/dump and other API endpoints accessible to non-admin clients, leaking arbitrary environment variables including SECRET_KEY for JWT forgery.

## Affected products

- unclecode Crawl4AI 0.9.0 through 0.9.3

## Timeline

- 2026-09-23: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5w5p-vcv6-mm3f](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5w5p-vcv6-mm3f)
- [https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.4-untrusted-config-gate-bypass-leaks-environment-variables](https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.4-untrusted-config-gate-bypass-leaks-environment-variables)

## Related threats

- [Crawl4AI blind SSRF in CacheValidator proxy bypass](https://junglewise.ai/threats/cve-2026-119122-crawl4ai-before-0-9-5-contains-a-blind-server-side-request)
- [Crawl4AI JavaScript injection in Docker API server](https://junglewise.ai/threats/cve-2026-119121-crawl4ai-from-0-9-0-before-0-9-5-contains-a-javascript-injection)
- [Crawl4AI untrusted model loading in CosineStrategy](https://junglewise.ai/threats/cve-2026-119120-crawl4ai-from-0-9-0-before-0-9-5-fails-to-filter-the)
- [Crawl4AI denial of service in Docker API server](https://junglewise.ai/threats/cve-2026-119119-crawl4ai-before-0-9-5-contains-a-denial-of-service-vulnerability)
- [Crawl4AI improper certificate validation in Chromium launch](https://junglewise.ai/threats/cve-2026-119118-crawl4ai-before-0-9-5-contains-an-improper-certificate)