CVE-2026-46497: Crawlee SSRF Vulnerability

CVE-2026-46497 Overview

Crawlee is a Python web scraping and browser automation library maintained by Apify. CVE-2026-46497 is a Server-Side Request Forgery (SSRF) vulnerability affecting Crawlee versions 1.0.0 through versions prior to 1.7.0. The flaw allows attackers to coerce the library into issuing HTTP requests to attacker-influenced URLs derived from sitemap files. The maintainers patched the issue in version 1.7.0. The vulnerability is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Applications using Crawlee to process untrusted sitemaps can be tricked into requesting attacker-chosen URLs, exposing internal services or leaking limited response data.

Affected Products

Crawlee for Python versions 1.0.0 through 1.6.x
Applications embedding Crawlee for sitemap-driven crawling workflows
Automated scraping pipelines that ingest third-party sitemap URLs

Discovery Timeline

2026-06-10 - CVE CVE-2026-46497 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46497

Vulnerability Analysis

Crawlee parses sitemap files to enumerate URLs and dispatch crawler requests. Before version 1.7.0, the library accepted URLs derived from sitemap entries without sufficient validation against unsafe schemes or internal network targets. An attacker controlling a sitemap referenced by a Crawlee job can supply URLs that point to internal services, cloud metadata endpoints, or other resources reachable from the host running the crawler.

The Apify maintainers published the fix in the GitHub Release v1.7.0 and documented the issue in GitHub Security Advisory GHSA-3r75-xc34-5f44.

Root Cause

The root cause is missing URL validation when expanding entries pulled from sitemap documents. Crawlee treated sitemap-derived URLs as trusted crawl targets and issued outbound requests without enforcing host or scheme allowlists. This violates the SSRF prevention principle of validating server-side request destinations before fetching them.

Attack Vector

Exploitation requires the victim application to load a sitemap that the attacker influences. An attacker hosts or modifies a sitemap to include URLs targeting internal IP ranges, loopback interfaces, or cloud provider metadata endpoints. When Crawlee processes the sitemap, it issues HTTP requests to those URLs from the crawler host, returning content or side-channel signals to the attacker workflow.

The vulnerability requires user interaction because the victim must initiate a crawl of an attacker-controlled or compromised sitemap source. No verified public proof-of-concept code is available. Refer to the security advisory for technical details.

Detection Methods for CVE-2026-46497

Indicators of Compromise

Outbound HTTP requests from crawler hosts to RFC1918 ranges, 169.254.169.254, or localhost originating from Crawlee processes
Sitemap entries containing non-HTTP schemes such as file://, gopher://, or ftp://
Unexpected crawl targets in Crawlee request logs that do not match the configured seed domains

Detection Strategies

Inspect Crawlee request queues and logs for URLs whose hostnames resolve to internal addresses.
Compare sitemap-derived URLs against an allowlist of approved crawl domains before execution.
Hook outbound HTTP libraries used by Crawlee to record and review every destination requested during a crawl.

Monitoring Recommendations

Forward crawler host network telemetry to a centralized SIEM and alert on traffic to metadata IPs and internal subnets.
Track installed crawlee package versions across build pipelines and production hosts to identify versions below 1.7.0.
Review dependency manifests (requirements.txt, pyproject.toml, poetry.lock) for pinned vulnerable Crawlee versions.

How to Mitigate CVE-2026-46497

Immediate Actions Required

Upgrade Crawlee to version 1.7.0 or later in all environments that ingest sitemaps.
Restrict crawler egress with a network policy that blocks access to internal subnets and cloud metadata endpoints.
Validate sitemap sources and reject sitemaps fetched from untrusted origins.

Patch Information

The vendor fix is included in Crawlee for Python 1.7.0. Release notes are available in the GitHub Release v1.7.0. The coordinated advisory is published as GHSA-3r75-xc34-5f44. Update the dependency pin and rebuild affected container images.

Workarounds

Run Crawlee inside a network namespace or container with egress filtering that denies private address ranges.
Pre-filter sitemap entries through an application-level allowlist before passing them to Crawlee.
Disable sitemap-based URL discovery in jobs that process third-party or user-submitted sources until the upgrade is deployed.

bash

# Configuration example
pip install --upgrade 'crawlee>=1.7.0'
pip show crawlee | grep -i version