High severity8.6NVD Advisory· Published Jul 10, 2026· Updated Jul 13, 2026
CVE-2026-56261
CVE-2026-56261
Description
Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/crawl4ai-server-side-request-forgery-via-webhook-urlsnvdProductThird Party Advisory
News mentions
0No linked articles in our index yet.