Executive brief
Crawl4AI, an open-source tool used to crawl and scrape web content for Large Language Models (LLMs), contains a security flaw in its web-facing endpoints. An attacker can use the tool to make unauthorized requests to internal company servers or cloud management services that are normally hidden from the internet. This could lead to the exposure of sensitive internal data, cloud credentials, or configuration details.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Crawl4AI's primary crawl endpoints (/crawl, /crawl/stream, /md, and /llm) due to insufficient validation of user-supplied URLs. While the application implements a blocklist for internal addresses, attackers can bypass these protections using IPv6-mapped IPv4 addresses (e.g., [::ffff:169.254.169.254]). This allows unauthenticated remote attackers to force the server to fetch data from internal network resources, Docker networks, or cloud metadata services (IMDS). The issue is resolved in version 0.8.7, which introduces normalized URL validation and a more robust blocklist check.
Affected products
- unclecode Crawl4AI < 0.8.7
Timeline
- 2026-06-02: advisory: Vendor security advisory published (GHSA-365w-hqf6-vxfg)
- 2026-06-22: disclosed: CVE-2026-56266 published to NVD
- 2026-06-22: patched: Fix released in version 0.8.7