Executive brief
Crawl4AI, an open-source web crawling tool, contains a security flaw in its monitoring interface. This vulnerability allows unauthorized individuals to access administrative monitoring functions without a password. An attacker could use this access to disrupt services or perform destructive cleanup operations, potentially impacting the availability of the crawling infrastructure.
Technical details
An authentication bypass vulnerability exists in the Crawl4AI Docker API server due to missing security dependencies on the monitor router. Specifically, the router was mounted without the 'token_dep' dependency, leaving endpoints such as /monitor/actions/cleanup and the WebSocket /monitor/ws accessible without a valid token. A remote, unauthenticated attacker can exploit this to manipulate the monitoring state or trigger destructive actions. This issue is classified as CWE-306 (Missing Authentication for Critical Function). The vulnerability is resolved in version 0.8.7 by adding the necessary dependency checks to the monitor router and WebSocket endpoints.
Affected products
- unclecode Crawl4AI < 0.8.7
Timeline
- 2026-06-02: advisory: Initial security advisory published by vendor
- 2026-06-24: disclosed: CVE-2026-56262 published to NVD