CVE-2026-53754 Details
Description
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 169.254.169.254) despite the filter by encoding an internal IPv4 address inside an IPv6 transition form, or by using the IPv6 unspecified address. Because the Docker API is unauthenticated by default (jwt_enabled: false), no credentials are required. This vulnerability is fixed in 0.8.8.
A server-side request forgery (SSRF) vulnerability has been identified in Crawl4AI versions prior to 0.8.8. The issue arises from the Docker API server's SSRF protection, which relied on an incomplete IPv4/IPv6 CIDR blocklist. This oversight allowed an unauthenticated attacker to access internal services and cloud metadata endpoints, such as 169.254.169.254. Exploitation was possible by encoding an internal IPv4 address in an IPv6 transition form or by using the IPv6 unspecified address. The vulnerability is particularly concerning because the Docker API is unauthenticated by default, requiring no credentials for access.
Users are advised to upgrade to Crawl4AI version 0.8.8 or later. Additionally, enabling authentication and restricting the container's outbound network access can help mitigate the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-4qqr-vv2q-cmr5 | [email protected] | Third Party AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kidocode crawl4ai | < 0.8.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |