CVE-2026-109237 in crawl4ai
Summary
by MITRE • 10/12/2026
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Crawl4AI versions prior to 0.9.4 represents a critical untrusted configuration gate bypass that fundamentally undermines the application's access control mechanisms. This flaw stems from an insufficient validation of input data types during the deserialization or parsing process for API configurations. Specifically, the system fails to strictly enforce type constraints on configuration objects, allowing attackers to exploit Python's dynamic typing by wrapping sensitive configuration parameters within dict-type wrappers. By constructing a laundered LLMConfig object where critical fields such as api_token are set to environment variable references rather than literal strings, an attacker can bypass standard authentication checks that typically validate the format and origin of these tokens.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of administrative credentials within the application. By leveraging the /config/dump endpoint with a crafted request containing the wrapped configuration object, attackers can force the system to resolve environment variable references in contexts where they are not intended or secured. This mechanism allows for the extraction of sensitive data including the SECRET_KEY and various provider API keys that were previously protected by administrative privileges. The exposure of these secrets is particularly dangerous because it enables further exploitation vectors such as admin JWT forgery, allowing attackers to impersonate administrators and gain full control over the application's functionality and underlying infrastructure without valid credentials.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to enforce strict type checking on configuration inputs. It also relates to CWE-798 Use of Hard-coded Credentials if the environment variables contain static secrets that are inadvertently exposed through improper handling. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1528 Steal Application Access Tokens, as it involves the theft and misuse of authentication tokens derived from compromised configuration data. The bypass mechanism also reflects aspects of CWE-94 Improper Control of Generation of Code (Code Injection) if the environment variable resolution leads to unintended code execution or state manipulation within the application logic.
Mitigation strategies must focus on enforcing strict input validation at the API gateway and serialization layers. Developers should implement type checking that rejects any configuration objects not matching the expected schema exactly, ensuring that fields like api_token are validated as plain strings rather than accepting complex structures or wrappers that might contain environment variable references. Additionally, implementing allowlists for permitted configuration keys can prevent unauthorized modification of sensitive settings. It is crucial to upgrade immediately to version 0.9.4 or later where these validation checks have been hardened. In the interim, restricting access to the /config/dump endpoint and ensuring that environment variables containing secrets are not resolvable in untrusted contexts will help reduce the attack surface until a permanent patch can be deployed.