CVE-2026-91943 Overview
CVE-2026-91943 is a server-side request forgery (SSRF) vulnerability in Crawl4AI versions before 0.9.3. The flaw resides in the PDFContentScrapingStrategy component, specifically the _get_pdf_path() function. This function re-downloads target URLs using Python requests without validating egress destinations. Authenticated attackers can submit URLs that redirect to internal addresses or leverage DNS rebinding to reach internal services. Response content is then exfiltrated through PDF text extraction embedded in crawl results. The vulnerability maps to CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can pivot from the Crawl4AI service to reach internal-only endpoints, cloud metadata services, and other network resources otherwise unreachable from the internet.
Affected Products
- Crawl4AI versions prior to 0.9.3
- Deployments using PDFContentScrapingStrategy for PDF ingestion
- Any application embedding Crawl4AI as a library for authenticated crawl workflows
Discovery Timeline
- 2026-09-15 - CVE-2026-91943 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91943
Vulnerability Analysis
Crawl4AI supports PDF ingestion through the PDFContentScrapingStrategy class. When a crawl target resolves to a PDF, the strategy invokes _get_pdf_path() to download the file for text extraction. This helper uses the Python requests library directly and does not apply any allow-list, deny-list, or IP validation before issuing the HTTP call.
Because the request layer follows HTTP redirects and honors DNS resolution at request time, an attacker-supplied URL can point at an external host that redirects to an internal IP such as 169.254.169.254, 127.0.0.1, or an RFC1918 range. DNS rebinding further bypasses any check performed at submission time, since the second lookup resolves to an internal address.
The downloaded response is parsed as a PDF, and extracted text is surfaced in the crawl result returned to the attacker. This turns the crawl output into an exfiltration channel for internal HTTP responses, even when the target is not a real PDF but is rendered as text.
Root Cause
The root cause is missing egress validation in _get_pdf_path(). The function trusts caller-provided URLs and does not validate the resolved destination address before issuing the request. There is also no separation between the initial fetcher and the PDF re-download path, so URL policy enforced elsewhere in Crawl4AI is bypassed.
Attack Vector
Exploitation requires authenticated access to the Crawl4AI API or an application that exposes it. The attacker submits a crawl job pointing at a URL under their control that responds with a redirect to an internal service, or a hostname configured for DNS rebinding. Crawl4AI issues the follow-up request from its own network position and returns extracted content to the caller. Cloud metadata services, internal admin panels, and unauthenticated intranet APIs are typical targets.
The vulnerability is described in prose only; no verified public exploit code is available. See the GitHub Security Advisory GHSA-q5rj-45vw-vp2g and the VulnCheck SSRF Advisory for further technical detail.
Detection Methods for CVE-2026-91943
Indicators of Compromise
- Outbound HTTP requests from the Crawl4AI host to RFC1918 ranges, loopback, or link-local addresses such as 169.254.169.254.
- Crawl job submissions containing URLs whose DNS records have very short TTLs, a signature of DNS rebinding.
- Crawl results containing text that resembles cloud metadata responses, internal error pages, or intranet HTML.
Detection Strategies
- Instrument the Crawl4AI process with egress logging and alert on connections to non-routable networks.
- Correlate submitted crawl URLs with resolved destination IPs at request time to detect redirect-to-internal patterns.
- Review crawl output stores for tokens, credentials, or metadata field names commonly returned by cloud provider IMDS endpoints.
Monitoring Recommendations
- Forward Crawl4AI application logs and host network flows to a centralized analytics platform for correlation.
- Baseline normal crawl destinations and alert on statistically rare internal destinations.
- Monitor authentication logs for crawl API accounts issuing atypical volumes of PDF-targeted jobs.
How to Mitigate CVE-2026-91943
Immediate Actions Required
- Upgrade Crawl4AI to version 0.9.3 or later on every deployment that uses PDFContentScrapingStrategy.
- Restrict outbound network access from Crawl4AI hosts to only the destinations required for crawling.
- Rotate any credentials or tokens exposed through cloud metadata services if SSRF activity is suspected.
Patch Information
The issue is fixed in Crawl4AI 0.9.3. Refer to the GitHub Security Advisory GHSA-q5rj-45vw-vp2g for patch details and to the VulnCheck SSRF Advisory for additional context on the fix.
Workarounds
- Disable or remove PDFContentScrapingStrategy from crawl configurations until the upgrade is applied.
- Route Crawl4AI outbound traffic through an egress proxy that blocks RFC1918, loopback, link-local, and cloud metadata IP ranges.
- Enforce IMDSv2 on AWS instances hosting Crawl4AI to reduce the value of metadata-targeted SSRF.
- Require authentication for internal services so an SSRF-obtained response contains no sensitive content.
# Configuration example
pip install --upgrade 'crawl4ai>=0.9.3'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
