CVE-2026-119122 in Crawl4AI
Summary
by MITRE • 10/29/2026
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
Crawl4AI versions prior to 0.9.5 are susceptible to a critical blind server-side request forgery vulnerability within its Docker-based architecture, specifically triggered through the API endpoint that controls cache validation behavior. The core technical flaw resides in the improper handling of the check_cache_freshness parameter when interacting with internal caching mechanisms and external network resources. By enabling this flag, an authenticated or unauthenticated attacker can manipulate how the application validates cached content against remote URLs. This manipulation allows the server to initiate outbound HTTP requests on behalf of the client without proper validation of the destination address, effectively bypassing configured egress proxies that are typically designed to restrict traffic to known safe domains and prevent access to internal network segments.
The operational impact of this vulnerability is severe due to its potential for unauthorized network reconnaissance and data exfiltration from isolated environments. Attackers can exploit this flaw by first caching a controlled URL, which serves as the initial vector for the attack chain. Once cached, the attacker triggers the CacheValidator component, forcing it to follow HTTP 302 redirects or leverage DNS rebinding techniques. These mechanisms allow the request to resolve to internal IP addresses that are otherwise inaccessible from the public internet. This capability enables attackers to perform port scanning and service discovery against internal infrastructure components such as databases, message queues, and other microservices running within the same network segment or cloud environment.
Furthermore, this vulnerability facilitates access to sensitive cloud-metadata endpoints, which often contain authentication tokens, IAM roles, and configuration secrets essential for maintaining secure operations in containerized environments. By redirecting requests to these metadata services, attackers can retrieve credentials that may be used to escalate privileges further within the compromised system or lateral move across other connected resources. The blind nature of this SSRF means that while direct response data might not always be returned to the attacker immediately, the side effects such as successful connection attempts or specific error codes from internal services can still reveal valuable information about the network topology and running services.
To mitigate this risk, organizations must upgrade Crawl4AI to version 0.9.5 or later where these validation checks have been hardened. In addition to software updates, it is crucial to implement strict egress filtering rules that whitelist only specific required external domains rather than relying solely on proxy configurations for security boundaries. Network segmentation should be enforced to isolate critical internal services from any components exposed to untrusted inputs. Additionally, implementing DNS rebinding protection mechanisms and ensuring that cache validation processes do not follow redirects without explicit allow-listing of target hosts can significantly reduce the attack surface associated with this type of server-side request forgery.
This vulnerability aligns with CWE-918 which classifies Server-Side Request Forgery flaws where the web server makes requests to URLs provided by users without sufficient validation. It also maps directly to MITRE ATT&CK technique T1571, specifically relating to non-standard ports and protocols used for command and control or data exfiltration via SSRF. The exploitation path described involves establishing a foothold through cache manipulation followed by network discovery using redirect following and DNS resolution tricks, highlighting the importance of validating not just input content but also the behavioral outcomes of application logic when interacting with external networks.