CVE-2026-56266: Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56266?
CVE-2026-56266 has a critical severity rating of 9.2.
How do I fix CVE-2026-56266?
To fix CVE-2026-56266, update Crawl4AI to version 0.8.7 or later.
What type of vulnerability is CVE-2026-56266?
CVE-2026-56266 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What impact does CVE-2026-56266 have?
Exploiting CVE-2026-56266 allows unauthenticated attackers to bypass internal address restrictions and access sensitive network resources.
Which endpoints are affected by CVE-2026-56266?
CVE-2026-56266 affects the /crawl, /crawl/stream, /md, and /llm endpoints in Crawl4AI.