CRITICAL🇵🇱 Wersja polska

CVE-2026-56261

CVSS 9.2v4.0pub. 2026-07-10upd. 2026-07-13

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Kidocode Crawl4ai

    APP
    Kidocode
    < 0.8.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRFContainer
CWE
References

Related vulnerabilities

CVE-2026-57572CRITICAL10.0PL ✓same product

Crawl4AI: RCE przez wstrzyknięcie argumentów Chromium w Docker API

CVE-2026-57571CRITICAL9.6PL ✓same product

Crawl4AI: path traversal umożliwiający zapis dowolnych plików i RCE

CVE-2026-56264CRITICAL9.2PL ✓same product

Crawl4AI: Dowolne wykonanie JavaScript przez endpoint /execute_js

CVE-2026-56258CRITICAL9.2PL ✓same product

Crawl4AI: zapis dowolnych plików poza katalogiem przez path traversal i TOCTOU

CVE-2026-53753CRITICAL9.8PL ✓same product

RCE w Crawl4AI — ucieczka z sandbox poprzez atrybuty generatorów Python