CVE-2026-53755: Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Summary
The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.
Affected paths
/crawl, /crawl/stream, and /crawl/job accept a browserconfig (and crawlerconfig). The following all feed Chromium's egress and were unchecked: - browserconfig.proxyconfig.server - browserconfig.proxy (deprecated field) - crawlerconfig.proxyconfig.server - --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browserconfig.extraargs
Attack
An attacker sends /crawl with a benign, validation-passing URL but a proxyconfig.server pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (results[0].html / cleanedhtml / markdown). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.
Impact
Unauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.
Fix
Every proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not isglobal, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from extraargs. A legitimate public proxy still works. Honors CRAWL4AIALLOWINTERNALURLS.
Workarounds
- Upgrade to the patched version (0.8.9). - Enable authentication (CRAWL4AIAPITOKEN). - Restrict the container's outbound network access (egress firewall / no metadata route).
Credits
Geo (geo-chen) - reported the proxyconfig.server SSRF with a clear PoC.
Other sources
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default. /crawl, /crawl/stream, and /crawl/job accept a browserconfig (and crawlerconfig). The following all feed Chromium's egress and were unchecked: browserconfig.proxyconfig.server, browserconfig.proxy (deprecated field), crawlerconfig.proxyconfig.server, and --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browserconfig.extraargs. This vulnerability is fixed in 0.8.9.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/crawl4aito a version that resolves this vulnerability.Fixed in 0.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.8.9 - Configuration
Enable authentication by setting CRAWL4AI_API_TOKEN so unauthenticated requests to the Docker API (e.g., /crawl, /crawl/stream, /crawl/job) are rejected.
Crawl4AI Docker API / crawling endpoint CRAWL4AI_API_TOKEN = Enable authentication - Configuration
Ensure browser_config.proxy_config.server is not set to internal IPs; proxy destinations must be validated with the same global-routability check used for crawl target URLs (reject any resolved address that is not is_global, including IPv6 transition forms) before constructing the browser.
browser_config (proxy settings) browser_config.proxy_config.server = Only allow globally routable destinations - Configuration
Avoid/stop using the deprecated browser_config.proxy field (and proxy/DNS-redirecting flags in browser_config.extra_args) since they are the proxy inputs that can feed Chromium egress; ensure they are stripped/ignored.
browser_config (deprecated proxy field) browser_config.proxy = Do not use / strip proxy flags - Configuration
Ensure crawler_config.proxy_config.server is not set to internal IPs; proxy destinations must be validated with the same global-routability check used for crawl target URLs (reject any resolved address that is not is_global, including IPv6 transition forms) before the browser is constructed.
crawler_config (proxy settings) crawler_config.proxy_config.server = Only allow globally routable destinations - Configuration
Do not supply attacker-controlled proxy/DNS-redirecting Chromium flags via browser_config.extra_args (e.g., --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules); ensure these are stripped before constructing Chromium.
browser_config.extra_args (Chromium proxy flags) --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules = Do not set or strip these flags - Compensating control
Restrict the container's outbound network access (egress firewall / no metadata route) to prevent access to internal services and cloud-metadata endpoints (e.g., block 169.254.169.254).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53755?
The severity of CVE-2026-53755 is high, with a score of 8.6.
What type of vulnerability is identified in CVE-2026-53755?
CVE-2026-53755 is a Server-Side Request Forgery (SSRF) vulnerability.
How can CVE-2026-53755 be exploited?
CVE-2026-53755 can be exploited by sending an unauthenticated request with a proxy pointing to an internal IP, allowing access to internal services.
What impact does CVE-2026-53755 have on security?
CVE-2026-53755 can potentially expose internal services and cloud-metadata endpoints to unauthorized access.
How do I fix CVE-2026-53755?
To fix CVE-2026-53755, ensure that the Docker API server applies proper SSRF checks to both the crawl target URL and the proxy address.