Executive brief
Crawl4AI is an open-source tool used to scrape and crawl websites for use with Large Language Models (LLMs). A security flaw in its Docker API server allows unauthorized users to bypass security checks by providing a malicious proxy address. This could allow an attacker to access sensitive internal services, private data, or cloud credentials (such as AWS metadata) that are normally protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Crawl4AI Docker API server prior to version 0.8.9. While the application validates the target crawl URL, it fails to validate proxy addresses provided in the browser_config or crawler_config. An unauthenticated attacker can submit a request with a benign crawl URL but a malicious proxy server pointing to internal IP addresses or cloud metadata endpoints (e.g., 169.254.169.254). Because the Docker API is unauthenticated by default and Chromium routes egress through the provided proxy, attackers can retrieve sensitive information from internal environments. The issue is fixed in version 0.8.9 by applying global-routability checks to all proxy destinations.
Affected products
- unclecode Crawl4AI < 0.8.9
Timeline
- 2026-06-04: advisory: GitHub security advisory published
- 2026-06-23: disclosed: NVD publication date