Executive brief
Crawl4AI is an open-source tool used to scrape web content for use with Artificial Intelligence models. A security flaw in its Docker-based server allows unauthorized users to force the tool to access internal company websites or private cloud configuration services that should not be reachable from the public internet. This could lead to the theft of sensitive internal data or cloud access credentials, potentially compromising the entire cloud environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Crawl4AI's Docker API server due to missing destination validation in the streaming request handler. While the standard `/crawl` path implemented SSRF protections, the `handle_stream_crawl_request` function (used by `/crawl/stream` and `/crawl` with `stream=true`) passed URLs directly to the crawler without checking if they pointed to internal, private, or link-local addresses. An unauthenticated remote attacker can exploit this to scan internal networks or retrieve sensitive data from cloud metadata services (e.g., AWS/GCP metadata endpoints at 169.254.169.254). The issue is resolved in version 0.9.0 by applying global-routability checks to all seed URLs in the streaming handler.
Affected products
- unclecode crawl4ai < 0.9.0
Timeline
- 2026-06-18: patched: Fix included in version 0.9.0 release
- 2026-07-06: disclosed: CVE-2026-57573 published