CVE-2026-112363 in Crawl4AI
Summary
by MITRE • 10/19/2026
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
Crawl4AI versions ranging from 0.8.7 through 0.9.5 are affected by a critical server-side request forgery vulnerability within its Docker API server component. This flaw stems from an inconsistency in how the application parses URL userinfo fields, specifically when handling URLs that contain embedded credentials or authentication data prior to the host portion of the URI. The core technical issue lies in the SSLCertificate.from_url method, which fails to properly validate and sanitize the destination address before initiating a connection. By exploiting differences between standard URL parsing libraries and Python's urllib implementation regarding userinfo segments, an attacker can craft malicious URLs that appear to target external resources but are actually resolved by the server as internal network addresses. This bypasses any existing destination checks designed to restrict outbound connections to whitelisted or safe domains, effectively allowing unauthenticated actors to redirect requests into the local environment where Crawl4AI is deployed.
The operational impact of this vulnerability is significant for organizations running Crawl4AI in containerized environments with access to internal services. An attacker can leverage the fetch_ssl_certificate parameter set to true in conjunction with a crafted URL containing specific userinfo syntax to force the server to initiate an SSL handshake with internal hosts on port 443. This capability transforms the vulnerability into a powerful network reconnaissance tool, enabling attackers to probe for reachable internal services that may not be exposed publicly but are accessible from within the container's network namespace. Furthermore, because the exploit involves fetching SSL certificates, it allows adversaries to extract certificate details such as common names and subject alternative names. These details can reveal information about other internal systems, their identities, and potentially aid in further targeted attacks against those services or facilitate man-in-the-middle attacks if valid but misconfigured certificates are obtained.
This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), as it allows an attacker to influence the server to make requests to unintended destinations. It also maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Movement via Service Discovery, depending on how the retrieved certificate information is utilized in a broader attack chain. The lack of authentication required for this exploit makes it particularly dangerous in public-facing deployments where API endpoints are accessible without strict access controls. To mitigate this risk, immediate updates to Crawl4AI versions 0.9.6 or later are strongly recommended as they address the URL parsing logic and enforce stricter destination validation. In environments where upgrading is not immediately feasible, administrators should implement network-level restrictions such as firewall rules that block outbound connections from the container on port 443 except for explicitly allowed external domains. Additionally, deploying a reverse proxy with strict input sanitization can help filter out malformed URLs containing userinfo segments before they reach the application layer, providing an additional defense-in-depth measure against SSRF exploitation attempts.