CVE-2026-109237: Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables

Q: Which deployments are exposed?

Crawl4AI versions 0.9.0 through versions before 0.9.4 are affected. Exposure requires the API to be reachable by a non-admin client that can use the /config/dump endpoint.

Q: What does an attacker need to exploit this issue?

The attacker needs non-admin API access; no user interaction is required. They can bypass the untrusted-config restriction by placing a forbidden LLMConfig inside dict-type wrappers and setting api_token to an environment-variable reference.

Q: What is the practical impact if exploitation succeeds?

An attacker can read SECRET_KEY and provider keys from environment variables through /config/dump. Access to SECRET_KEY can enable forging administrator JWTs.

Q: How can I determine whether exploitation may have occurred?

Review /config/dump requests from non-admin clients for dict-wrapped configuration objects, especially LLMConfig values with api_token referencing environment variables. Also investigate signs of administrator JWTs that may have been forged after exposure of the SECRET_KEY.

Published Oct 12, 2026

Updated

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETKEY and provider keys, enabling admin JWT forgery.

Affected Software

1 affected component

Crawl4AI Crawl4AI>=0.9.0<0.9.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Crawl4AI to a version that resolves this vulnerability.
Fixed in 0.9.4

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Crawl4AI versions 0.9.0 through versions before 0.9.4 are affected. Exposure requires the API to be reachable by a non-admin client that can use the /config/dump endpoint.

What does an attacker need to exploit this issue?

The attacker needs non-admin API access; no user interaction is required. They can bypass the untrusted-config restriction by placing a forbidden LLMConfig inside dict-type wrappers and setting api_token to an environment-variable reference.

What is the practical impact if exploitation succeeds?

An attacker can read SECRET_KEY and provider keys from environment variables through /config/dump. Access to SECRET_KEY can enable forging administrator JWTs.

How can I determine whether exploitation may have occurred?

Review /config/dump requests from non-admin clients for dict-wrapped configuration objects, especially LLMConfig values with api_token referencing environment variables. Also investigate signs of administrator JWTs that may have been forged after exposure of the SECRET_KEY.

CVE-2026-109237: Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact if exploitation succeeds?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact if exploitation succeeds?

How can I determine whether exploitation may have occurred?