Improper Certificate Validation in Crawl4AI by UncleCode
CVE-2026-119118

8.3HIGH

Key Information:

Vendor

Unclecode

Status
Crawl4ai
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119118?

Crawl4AI, a web crawling tool developed by UncleCode, has a vulnerability related to improper certificate validation. Versions prior to 0.9.5 do not validate SSL certificates correctly due to hard-coded launch flags in Chromium, specifically "--ignore-certificate-errors". This oversight allows network attackers, especially those executing man-in-the-middle attacks or controlling DNS, to intercept and manipulate data during web crawls. Attackers may serve forged content and gain access to sensitive information, including cookies and HTTP headers, thereby compromising the integrity of the web crawling process.

Affected Version(s)

crawl4ai 0 < 0.9.5

crawl4ai 0.9.5

References

https://github.com/unclecode/crawl4ai/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/crawl4ai-before-0.9....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ntohidi
.