CVE-2026-53755 json
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
published 2026-06-16 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-38567 , GHSA-6qhc-x826-342c , PYSEC-2026-588
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default. /crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked: browser_config.proxy_config.server, browser_config.proxy (deprecated field), crawler_config.proxy_config.server, and --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser_config.extra_args. This vulnerability is fixed in 0.8.9.
Patch / fix
- pypi crawl4ai 0.8.9
- kidocode crawl4ai 0.8.9
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template crawl4ai < 0.8.9 - Server Side Request Forgery nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | crawl4ai | <0.8.9 |
0.8.9 |
Affected products
- unclecode crawl4ai
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/unclecode/crawl4ai/security/advisories/GHSA-6qhc-x826-342c
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-53755
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-588.yaml
web
-
github.com
/unclecode/crawl4ai
package
Sources
- CVE List CVE-2026-53755
- GitHub Advisory GHSA-6qhc-x826-342c
- NVD CVE-2026-53755
- OSV PYSEC-2026-588
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.