CVE-2026-56262: Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
Published Jun 24, 2026
·Updated
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.
Affected Software
2 affected components
Crawl4AI Crawl4AI<0.8.7
Kidocode Crawl4ai<0.8.7
Event History
Jun 24, 2026
CVE Published
via MITRE·11:53 AM
Data Sourced
via MITRE·11:53 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-56262?
The severity of CVE-2026-56262 is medium with a CVSS score of 6.5.
2
How do I fix CVE-2026-56262?
To fix CVE-2026-56262, upgrade Crawl4AI to version 0.8.7 or later.
3
What impact does CVE-2026-56262 have on Crawl4AI?
CVE-2026-56262 allows unauthenticated attackers to exploit monitor router endpoints for destructive operations.
4
What components are affected by CVE-2026-56262?
CVE-2026-56262 affects the monitor endpoints accessed via the Docker API server in Crawl4AI.
5
Is authentication required to exploit CVE-2026-56262?
No, authentication is not required to exploit CVE-2026-56262.