CVE-2026-57573: Kidocode Crawl4ai SSRF Vulnerability

CVE-2026-57573 Overview

CVE-2026-57573 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Crawl4AI, an open-source LLM-friendly web crawler and scraper. Versions prior to 0.9.0 shipped a Docker API server that enforced destination validation only on the non-streaming /crawl endpoint. The streaming code path in handle_stream_crawl_request forwarded seed URLs directly to the crawler without validating the destination. A remote unauthenticated attacker can submit a request pointing at internal, private, or link-local addresses and receive the response body back. The maintainers fixed the flaw in version 0.9.0.

Critical Impact
Unauthenticated attackers can force the Crawl4AI Docker server to fetch arbitrary internal URLs and exfiltrate the response, exposing cloud metadata services, internal APIs, and private network resources.

Affected Products

Kidocode Crawl4AI versions prior to 0.9.0
Crawl4AI Docker API server deployments
Applications embedding the vulnerable handle_stream_crawl_request handler

Discovery Timeline

2026-07-06 - CVE-2026-57573 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-57573

Vulnerability Analysis

The Crawl4AI Docker API server exposes two crawl entry points: a non-streaming POST /crawl endpoint and a streaming POST /crawl/stream endpoint. The non-streaming handler validated user-supplied URLs against an SSRF destination allowlist before dispatching the crawler. The streaming handler, handle_stream_crawl_request, omitted this check entirely and passed seed URLs directly into the crawler pipeline.

Attackers can trigger the same behavior through POST /crawl by setting crawler_config.stream=true, which routes the request through the unprotected streaming path. Because no authentication is required and the server streams the full response body back, the flaw functions as a full read-SSRF primitive against internal infrastructure.

Root Cause

The root cause is inconsistent enforcement of the SSRF destination allowlist across code paths. Security controls applied to one handler were not replicated in the streaming counterpart. This is a classic case of a security check applied at the wrong layer, permitting a bypass whenever the client selects a code path that skips the check.

Attack Vector

Exploitation requires only network access to the Crawl4AI Docker API server. An attacker sends a crafted HTTP POST request specifying an internal target such as http://169.254.169.254/latest/meta-data/ (AWS instance metadata), http://127.0.0.1/, or an internal service address. The server fetches the URL and streams the raw response body to the attacker.

text

# Patch reference: version bump in Dockerfile
 FROM python:3.12-slim-bookworm AS build
 
 # C4ai version
-ARG C4AI_VER=0.8.9
+ARG C4AI_VER=0.9.0
 ENV C4AI_VERSION=$C4AI_VER
 LABEL c4ai.version=$C4AI_VER
# Source: https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2

Detection Methods for CVE-2026-57573

Indicators of Compromise

HTTP POST requests to /crawl/stream or /crawl with crawler_config.stream=true from untrusted sources
Outbound requests from the Crawl4AI container to 169.254.169.254, 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16
Streaming responses containing cloud metadata tokens, private hostnames, or internal API payloads

Detection Strategies

Inspect Crawl4AI access logs for POST requests targeting streaming endpoints with URLs resolving to RFC1918 or link-local ranges
Monitor egress traffic from Crawl4AI Docker containers for connections to cloud metadata endpoints
Alert on unauthenticated API calls that specify crawler_config.stream=true combined with non-public destination URLs

Monitoring Recommendations

Deploy egress firewall rules that log and drop connections from the Crawl4AI container to internal address spaces
Correlate application logs with network flow data to identify SSRF probing patterns
Track the deployed Crawl4AI version across containers and flag any instance below 0.9.0

How to Mitigate CVE-2026-57573

Immediate Actions Required

Upgrade Crawl4AI to version 0.9.0 or later, which enforces destination validation on both crawl paths
Restrict network access to the Crawl4AI Docker API server so it is not reachable from untrusted networks
Block the container from reaching cloud metadata services and internal management interfaces at the network layer

Patch Information

The fix is included in Crawl4AI 0.9.0 as part of the secure-by-default Docker server hardening release. Review the GitHub Security Advisory GHSA-wm69-2pc3-rmmf and the upstream commit for full details on the applied controls.

Workarounds

Place the Crawl4AI API behind an authenticated reverse proxy that filters destination URLs before forwarding
Run the container in a network namespace with no route to internal subnets or metadata endpoints
Disable or remove the /crawl/stream endpoint until upgrading is possible

bash

# Block container access to AWS/Azure/GCP metadata service
iptables -I DOCKER-USER -d 169.254.169.254 -j DROP
# Restrict container egress to public IP ranges only
iptables -I DOCKER-USER -s <crawl4ai_container_ip> -d 10.0.0.0/8 -j DROP
iptables -I DOCKER-USER -s <crawl4ai_container_ip> -d 172.16.0.0/12 -j DROP
iptables -I DOCKER-USER -s <crawl4ai_container_ip> -d 192.168.0.0/16 -j DROP