Executive brief
Crawl4AI is an open-source tool used to crawl and scrape websites for use with artificial intelligence models. A security flaw in its Docker-based server allows attackers to force the application to make unauthorized requests to internal systems. This could lead to the exposure of sensitive internal data, such as cloud infrastructure credentials or private network information, which are normally protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Crawl4AI's Docker API server within the /crawl/job and /llm/job endpoints. These endpoints accept user-supplied webhook URLs but fail to validate the destination address. An unauthenticated remote attacker can provide URLs pointing to internal IP ranges (RFC 1918), loopback addresses, or cloud metadata services (e.g., 169.254.169.254). This allows the attacker to probe internal network services or exfiltrate sensitive environment metadata. The issue is fixed in version 0.8.7 by implementing a blocklist for private and metadata IP ranges and hostnames, and disabling redirect following for webhooks.
Affected products
- Crawl4AI Crawl4AI < 0.8.7
Timeline
- 2026-06-02: advisory: Vendor security advisory published on GitHub
- 2026-07-10: disclosed: CVE published to NVD
- 2026-07-10: patched: Version 0.8.7 released with fixes