CVE-2026-109238 Overview
Crawl4AI versions 0.7.0 through 0.9.3 contain a server-side request forgery (SSRF) vulnerability [CWE-918] in the link_preview_config feature exposed on /crawl API requests. An unauthenticated API client can submit a controlled page with include_external and include_patterns enabled, triggering the AsyncUrlSeeder component to fetch arbitrary internal, private, and cloud metadata endpoints. The server returns the parsed head data from those internal responses, exposing sensitive information to the attacker. The flaw is fixed in Crawl4AI 0.9.4.
Critical Impact
Unauthenticated attackers can pivot through the Crawl4AI API to reach internal services and cloud instance metadata endpoints such as 169.254.169.254, retrieving credentials and configuration data.
Affected Products
- Crawl4AI 0.7.0 through 0.9.3
- Crawl4AI deployments exposing the /crawl endpoint with link_preview_config enabled
- Containerized Crawl4AI instances running in cloud environments (AWS, Azure, GCP) with reachable instance metadata services
Discovery Timeline
- 2026-10-12 - CVE-2026-109238 published to the National Vulnerability Database (NVD)
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109238
Vulnerability Analysis
The vulnerability resides in Crawl4AI's URL seeding logic, which the /crawl endpoint invokes when link_preview_config is present on an incoming request. When a client supplies a controlled HTML page as the crawl target and sets include_external to true, the AsyncUrlSeeder component iterates through links discovered on the page and performs outbound HTTP requests to retrieve metadata. The seeder does not restrict destination addresses, so links pointing to loopback addresses, private RFC 1918 ranges, or cloud metadata services are fetched identically to external URLs. Parsed response data from the <head> of each fetched page is returned to the API caller, giving the attacker a channel to read responses from internal services. This is classified as [CWE-918] Server-Side Request Forgery.
Root Cause
The root cause is missing destination validation in AsyncUrlSeeder. The component honors the include_patterns filter supplied by the request but does not enforce a deny-list for loopback, link-local, private, or cloud metadata address ranges before issuing fetches.
Attack Vector
Exploitation requires only network access to the Crawl4AI API. An attacker hosts an HTML page containing links pointing to internal targets, then issues a /crawl request against the vulnerable instance with link_preview_config enabled, include_external set to true, and include_patterns crafted to match internal hosts. The seeder follows the links, and the server returns parsed head data from each internal endpoint.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-wh5w-hmj3-vgg7 and the VulnCheck SSRF Advisory for additional technical detail.
Detection Methods for CVE-2026-109238
Indicators of Compromise
- Outbound HTTP requests from the Crawl4AI process to 169.254.169.254, metadata.google.internal, or Azure IMDS endpoints
- Crawl4AI access logs showing /crawl requests with link_preview_config, include_external=true, and include_patterns targeting internal hostnames or private IP ranges
- Unusual DNS resolutions for internal hostnames originating from the Crawl4AI service account
- Spikes in response payloads from /crawl containing cloud metadata keys such as iam/security-credentials
Detection Strategies
- Inspect application logs for requests that specify link_preview_config combined with include_external set to true
- Correlate egress firewall logs with the Crawl4AI container network namespace to flag connections to RFC 1918 or link-local addresses
- Deploy web application firewall rules that reject /crawl payloads referencing metadata endpoints in include_patterns
- Alert on process-level network activity from Crawl4AI reaching internal management ports (22, 2375, 6443, 8080)
Monitoring Recommendations
- Capture full request bodies for the /crawl endpoint and retain them for forensic review
- Monitor for new or expanded include_patterns values that reference internal infrastructure
- Track cloud instance metadata service (IMDS) access counts per workload identity and alert on anomalies
- Forward Crawl4AI logs and host network telemetry to a centralized data lake for cross-source correlation
How to Mitigate CVE-2026-109238
Immediate Actions Required
- Upgrade Crawl4AI to version 0.9.4 or later on all deployments
- Restrict network egress from Crawl4AI workloads to only the external domains required by business logic
- Block Crawl4AI access to cloud metadata endpoints by enforcing IMDSv2 with hop-limit 1 on AWS and equivalent controls on Azure and GCP
- Require authentication in front of the /crawl API if it is reachable from untrusted networks
Patch Information
The maintainer released Crawl4AI 0.9.4, which adds destination validation inside AsyncUrlSeeder to prevent fetching internal, private, and cloud metadata addresses. Upgrade instructions and the full patch commit are referenced in the GitHub Security Advisory GHSA-wh5w-hmj3-vgg7.
Workarounds
- Disable the link_preview_config feature by rejecting requests that include it at the reverse proxy layer
- Run Crawl4AI inside a network namespace that denies routes to RFC 1918, loopback, and link-local ranges
- Place an authenticating reverse proxy in front of /crawl and apply allow-lists for permitted destination domains
- Remove IAM role attachments from Crawl4AI workloads where cloud credentials are not required for operation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
