Executive brief
Crawl4AI, a tool used for web crawling and data extraction for AI models, contains a security flaw in its Docker API server. An attacker can trick the server into sending sensitive credentials, such as AI provider API keys or internal passwords, to a server they control. This could lead to unauthorized access to AI services or a complete bypass of the server's security protections.
Technical details
Crawl4AI's Docker API server is vulnerable to credential exfiltration and arbitrary environment variable disclosure. The first vector involves the `/md`, `/llm`, and `/llm/job` endpoints, which honor a user-provided `base_url` while automatically attaching the server's configured API keys, effectively performing a Server-Side Request Forgery (SSRF) that leaks credentials. The second vector involves the `LLMConfig` class, which uses `os.getenv` to resolve strings prefixed with `env:`. Because request bodies are deserialized into this class, an attacker can specify sensitive environment variables (like `SECRET_KEY` or `REDIS_PASSWORD`) to be read and then exfiltrated using the `base_url` vector. These vulnerabilities are particularly severe because the Docker API is unauthenticated by default. A fix is available in version 0.8.8 which ignores request-supplied base URLs and restricts environment variable resolution.
Affected products
- unclecode crawl4ai <= 0.8.7
Timeline
- 2026-06-04: disclosed: Initial report by researcher and internal audit discovery.
- 2026-06-16: advisory: GitHub Advisory published.
- 2026-06-16: patched: Version 0.8.8 released to address the issues.