Crawl4AI: Server-side request forgery via link preview configuration
Summary
Crawl4AI versions 0.7.0 to 0.9.3 contain a server-side request forgery (SSRF) flaw in the link preview feature of the URL seeder. An API client that can reach /crawl can enable link preview and supply a page it controls, so the server fetches internal, private, link-local and cloud-metadata addresses. According to the vendor, the parsed head content of these responses is returned to the caller, and no authentication is required when the API is deployed unauthenticated, which is the default.
Affected
- crawl4ai 0.7.0 up to and including 0.9.3 (Python library and Docker API server)
Fixed in
- crawl4ai 0.9.4 (vendor fix)
- The research notes report a further release, 0.9.5, which fixes a separate SSRF issue; the newest release is recommended
Workaround
- Strip link_preview_config from incoming crawler_config request bodies at a reverse proxy (vendor advice)
- Restrict the container's outbound network access with an egress firewall and no route to cloud metadata services (vendor advice)
- Enable authentication and limit who can call /crawl
Exploitation
- No evidence of in-the-wild exploitation found
- No public proof of concept found
- CISA SSVC: exploitation none, not automatable, technical impact partial
Our recommendation
- Inventory all Crawl4AI installations, including pip packages, Docker images and bundled apps
- Upgrade to the newest release, at least 0.9.4
- If the Docker API is exposed, restrict it to trusted networks, enable authentication and add egress controls
- Monitor the advisory and NVD for updates, as the NVD status is currently Deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wh5w-hmj3-vgg7 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-109238 osv.dev
- Crawl4AI changelog github.com
- Crawl4AI security page github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:43.
Original description (NVD)
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.