CVE-2026-56261: Crawl4AI - Server-Side Request Forgery via Webhook URLs
Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56261?
The severity of CVE-2026-56261 is critical with a score of 9.2.
What is CVE-2026-56261?
CVE-2026-56261 is a server-side request forgery (SSRF) vulnerability in Crawl4AI's Docker API server due to inadequate validation of webhook URLs.
How do I fix CVE-2026-56261?
To fix CVE-2026-56261, upgrade Crawl4AI to version 0.8.7 or higher.
What are the affected endpoints in CVE-2026-56261?
The affected endpoints in CVE-2026-56261 are /crawl/job and /llm/job.
Who is affected by CVE-2026-56261?
Users of Crawl4AI versions prior to 0.8.7 are affected by CVE-2026-56261.