CVE-2026-56266

HIGH

Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

Title source: cna
STIX 2.1

Description

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
https://www.vulncheck.com/advisories/crawl4ai-server-side-request-forgery-via-direct-crawl-endpoints

Scores

CVSS v3 8.6
EPSS 0.0028
EPSS Percentile 19.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-918
Status published
Products (4)
Crawl4AI/Crawl4AI < 0.8.7
Crawl4AI/Crawl4AI 0.8.7
kidocode/crawl4ai < 0.8.7
pypi/crawl4ai 0 - 0.8.7PyPI
Published Jun 22, 2026
Tracked Since Jun 23, 2026