CVE-2026-56266: Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

Synopsis

Server-side request forgery (SSRF) affects Crawl4AI before version 0.8.7, present in the /crawl, /crawl/stream, /md, and /llm endpoints, which fetch arbitrary user-supplied URLs without validation. The vulnerability is reachable over the network with no authentication required, and attackers can bypass the internal-address blocklist by supplying IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints (such as the AWS instance metadata service). A patched-image rebuild at version 0.8.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoints are exposed over the network, so an attacker must be able to send HTTP requests to the Crawl4AI service to exploit this vulnerability.

• AuthenticationNot required

  No credentials or session token are needed; the affected endpoints accept and process user-supplied URLs from unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator of the affected service.

• Attack complexityDetail

  The exploit is reliable and condition-free once the service is reachable; the only craft required is supplying an IPv6-mapped IPv4 address to bypass the internal-address blocklist, which is a well-documented technique with no race condition or environmental dependency.

Blast Radius

• Attacker reads responses from internal services on the host network, including private APIs, databases, or microservices not intended to be externally reachable.
• Attacker retrieves cloud instance metadata (for example, AWS IMDSv1 credentials, GCP service account tokens), which can be used to escalate access to the broader cloud environment.
• Confidentiality of data held by internal services is directly exposed; there is no write or availability impact to the Crawl4AI instance itself, but downstream systems reached via SSRF may be further compromised using harvested credentials.