Blind Server-Side Request Forgery in Crawl4AI by Unclecode
CVE-2026-119122

6.9MEDIUM

Key Information:

Vendor

Unclecode

Status
Crawl4ai
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119122?

Crawl4AI versions prior to 0.9.5 contain a severe vulnerability that allows attackers to exploit a blind server-side request forgery through the Docker server. By enabling the check_cache_freshness feature, malicious actors can cache a malicious URL. This facilitates the triggering of CacheValidator to follow 302 redirects or conduct DNS rebinding, leading to unauthorized access to internal services and exposure of cloud metadata. This vulnerability can significantly compromise the security of API clients and the integrity of the server's operations.

Affected Version(s)

crawl4ai 0 < 0.9.5

crawl4ai 0.9.5

References

https://github.com/unclecode/crawl4ai/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/crawl4ai-before-0.9....
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpe1618
ntohidi
.