SSRF Vulnerability in Crawl4AI Web Crawler by Uncle Code

CVE-2026-53755

What is CVE-2026-53755?

Crawl4AI, the open-source web crawler developed by Uncle Code, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.8.9. This flaw allows unauthenticated users to manipulate the proxy address, potentially exposing internal services and bypassing security restrictions. An attacker can supply a malicious proxy that routes traffic through internal IPs, gaining unauthorized access to sensitive cloud metadata endpoints. The vulnerability affects various functionalities of the Docker API server, as the checks on proxy configurations were not properly implemented, making it imperative for users to upgrade to version 0.8.9 for enhanced security. For detailed information, refer to the security advisory at GitHub.

References