GHSA-f989-c77f-r2cq: LLM Credential Exfiltration and SSRF in Crawl4AI Docker Server

Vulnerability ID: GHSA-F989-C77F-R2CQ
CVSS Score: 8.2
Published: 2026-06-16

A technical evaluation of the Crawl4AI open-source web crawling and scraping library revealed a high-severity credential exfiltration vulnerability in its self-hosted Dockerized API server. The flaw arises from an unvalidated base_url parameter in request payloads and a dynamic prefix resolution mechanism that retrieves system environment variables. Unauthenticated remote attackers can leverage these features in tandem to extract host-level secrets or redirect configured LLM API keys to an external listener under their control.

TL;DR

Unauthenticated remote attackers can exfiltrate LLM API keys and sensitive environment variables from Crawl4AI Docker servers by exploiting request-supplied base_url redirects and env-token resolution.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-200 / CWE-522 / CWE-918
• Attack Vector: Network (AV:N)
• CVSS v3.1: 8.2 (High)
• Exploit Status: Proof of Concept / Functional
• KEV Status: Not Listed
• Primary Impact: Exfiltration of LLM API credentials and host environment variables

Affected Systems

• Crawl4AI self-hosted Docker API Server (deploy/docker/api.py)
• Crawl4AI Python library (crawl4ai/async_configs.py)
• crawl4ai: <= 0.8.7 (Fixed in: 0.8.8)

Mitigation Strategies

• Upgrade the Crawl4AI package and associated Docker containers to version 0.8.8 or later
• Enable API Token Authentication on the Crawl4AI container using the CRAWL4AI_API_TOKEN environment variable
• Implement network egress filtering to restrict the container's outbound connections to authorized domains
• Minimize secret exposure by avoiding passing unnecessary environment variables to the container runtime environment

Remediation Steps:

1. Identify all running instances of Crawl4AI Docker containers in the environment
2. Stop existing container instances running version 0.8.7 or lower
3. Pull the updated Docker image using: docker pull unclecode/crawl4ai:0.8.8
4. Upgrade local Python environments using: pip install -U crawl4ai
5. Verify container startup logs to confirm execution of version 0.8.8 or later
6. Audit environment variables associated with the container to ensure only necessary keys are passed

References

• Official GitHub Security Advisory
• Repository Security Page Link
• GitHub Version Comparison & Patches
• Raw Patch Diff Link
• Repository Home Page

Read the full report for GHSA-F989-C77F-R2CQ on our website for more details including interactive diagrams and full exploit analysis.