CVE-2026-119118: Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AICHROMIUMSANDBOX.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Crawl4AI before 0.9.5 are exposed when they crawl over a network path that an attacker can intercept or when an attacker can control DNS resolution. The attacker can serve forged content to the crawler and observe cookies and headers it sends.
Does this require a non-default or explicitly insecure browser configuration?
No. Chromium is always launched with --ignore-certificate-errors in affected versions, so certificate validation is disabled regardless of the target site's certificate status. The hard-coded --no-sandbox flag also overrides the CRAWL4AI_CHROMIUM_SANDBOX setting.
What attacker access is needed to exploit the issue?
An attacker needs the ability to perform a man-in-the-middle attack on the crawler's network traffic or control DNS resolution for a crawled destination. No privileges or user interaction are required.
What is the available remediation?
Upgrade Crawl4AI to version 0.9.5 or later. The issue affects versions before 0.9.5.