Untrusted Config Gate Bypass in Crawl4AI by UncleCode

CVE-2026-109237

What is CVE-2026-109237?

The Crawl4AI application, versions prior to 0.9.4, has a vulnerability that allows non-admin API clients to bypass restrictions on configuration objects. By utilizing dict-type wrappers, attackers can manipulate the system to expose sensitive environment variables, including SECRET_KEY and provider keys, via the '/config/dump' endpoint. This exploitation can enable unauthorized generation of admin JWTs, leading to potential administrative privileges and further compromising the system.

References