Executive brief
Crawl4AI is a tool used to crawl websites and prepare data for Large Language Models (LLMs). A security flaw in its Docker API server allows unauthorized individuals to trick the system into sending sensitive information, such as API keys and internal passwords, to a server controlled by the attacker. This could lead to the theft of expensive AI service credentials or a complete takeover of the Crawl4AI server.
Technical details
Crawl4AI's Docker API server contains two primary vulnerabilities leading to credential exfiltration. First, the /md, /llm, and /llm/job endpoints are unauthenticated by default and honor a user-provided 'base_url' parameter, allowing for Server-Side Request Forgery (SSRF) where the server sends its configured provider API keys to an attacker-controlled URL. Second, the LLMConfig class improperly resolves environment variables when the 'api_token' is prefixed with 'env:', allowing attackers to read arbitrary server secrets like JWT SECRET_KEY or REDIS_PASSWORD. By combining these, a remote unauthenticated attacker can exfiltrate sensitive environment variables to an external endpoint. The issue is fixed in version 0.8.8 by ignoring request-supplied base URLs and restricting environment variable resolution.
Affected products
- Crawl4AI Crawl4AI < 0.8.8
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-12: disclosed: NVD publication date