CVE-2026-76164: AIL Framework SSRF Vulnerability

CVE-2026-76164 Overview

CVE-2026-76164 is a server-side request forgery (SSRF) vulnerability in the AIL Framework crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit arbitrary URLs without adequate destination host validation. The crawler then issues direct HTTP(S) requests to loopback addresses, RFC1918 private networks, link-local ranges, and cloud metadata services such as 169.254.169.254.

Manual crawler tasks bypass the existing domain blacklist because they are assigned a non-zero priority. IP literals are classified as web targets and fetched directly rather than through Tor or another proxy. The captured HTML, screenshots, and HAR data are accessible through the crawler interface, making this SSRF non-blind.

Critical Impact
Authenticated attackers can pivot through the AIL server to reach internal services and exfiltrate cloud instance metadata and credentials.

Affected Products

AIL Framework (versions prior to commit d7b60ff9e20ee493895430b1a7c63d498a8fd780)
Components: bin/lib/crawlers.py and var/www/blueprints/crawler_splash.py
Deployments exposing the crawler submission interface to authenticated users

Discovery Timeline

2026-08-19 - CVE-2026-76164 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76164

Vulnerability Analysis

The AIL Framework provides a crawler component that fetches URLs submitted by authenticated users. The crawler classifies destinations and routes them through Tor or directly depending on target type. The submission endpoint accepts arbitrary URLs and passes them to the fetch pipeline without validating that the resolved destination is a global, routable address.

Manual submissions receive a non-zero priority. This priority path skips the domain blacklist check that would otherwise filter dangerous hosts. IP literals are treated as web targets and fetched over direct HTTP(S), so an attacker can supply addresses like 127.0.0.1, 10.0.0.0/8, 169.254.169.254, or internal DNS names.

Captured HTML, screenshots, and HAR data return to the crawler interface. The attacker reads full responses, enabling extraction of internal application data, service banners, and cloud instance metadata including temporary credentials from AWS, Azure, or GCP metadata endpoints. This aligns with [CWE-918: Server-Side Request Forgery].

Root Cause

The submission handler in var/www/blueprints/crawler_splash.py invoked crawlers.extract_url_from_text(urls) and forwarded results to the fetch queue without host validation. No resolver check confirmed that destination IPs were globally routable before dispatch.

Attack Vector

An authenticated user with crawler access submits a URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ through the crawler interface. The AIL server fetches the response from its own network context and stores the captured content. The attacker then retrieves the captured HTML, screenshot, and HAR through the crawler results view.

python

# Patch in var/www/blueprints/crawler_splash.py
    urls = request.form.get('urls_to_crawl')
    if urls:
        urls = crawlers.extract_url_from_text(urls)
+       res = crawlers.api_validate_global_urls(urls=urls)
+       if res:
+           return create_json_response(res[0], res[1])
        l_cookiejar = crawlers.api_get_cookiejars_selector(user_org, user_id)
        crawlers_types = crawlers.get_crawler_all_types()
        proxies = []  # TODO HANDLE PROXIES
# Source: https://github.com/ail-project/ail-framework/commit/d7b60ff9e20ee493895430b1a7c63d498a8fd780

Detection Methods for CVE-2026-76164

Indicators of Compromise

Crawler tasks in the AIL database with destinations resolving to RFC1918, loopback, or link-local ranges
Outbound requests from the AIL server to 169.254.169.254 or other cloud metadata endpoints
Stored HAR or screenshot artifacts containing internal service responses or IAM credentials
Crawler submissions using bare IP literals rather than domain names

Detection Strategies

Review AIL crawler task history for URLs targeting private, loopback, or metadata IP ranges
Correlate authenticated user sessions with crawler submissions containing IP literals
Inspect stored HTML and HAR captures for keywords such as iam, security-credentials, token, or internal hostnames

Monitoring Recommendations

Log all crawler submission requests including submitter identity, submitted URL, and resolved destination IP
Alert on any egress from the AIL host to link-local 169.254.0.0/16 or loopback destinations
Baseline normal crawler destinations and flag deviations toward internal network ranges

How to Mitigate CVE-2026-76164

Immediate Actions Required

Update AIL Framework to a build that includes commit d7b60ff9e20ee493895430b1a7c63d498a8fd780
Restrict crawler submission privileges to trusted operator accounts only
Rotate any cloud instance credentials that may have been exposed via metadata service access
Audit stored crawler results for captures of internal services and purge sensitive artifacts

Patch Information

The upstream fix adds api_validate_global_urls in bin/lib/crawlers.py and calls it from the submission handler in var/www/blueprints/crawler_splash.py. The validator resolves crawler destinations and rejects URLs whose resolved addresses are not globally routable, blocking localhost, private-network, and link-local targets. See the GitHub Commit for AIL Framework.

Workarounds

Place the AIL server behind an egress proxy that denies traffic to RFC1918, loopback, and link-local ranges
Use IMDSv2 with hop-limit 1 on AWS instances to prevent metadata retrieval by application-level requests
Apply host firewall rules blocking outbound connections to 169.254.169.254 and internal management subnets
Deny direct crawler egress and force traffic through an inspecting proxy that enforces allowlists

bash

# Example iptables rules to block metadata and loopback egress from AIL host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner ail -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner ail -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner ail -j REJECT