{"data":{"id":"919ed641-a0e7-49df-82cb-cd738b457a8a","title":"GHSA-f989-c77f-r2cq: Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution","summary":"The Docker API server of Crawl4AI let requests control the LLM endpoint through the base_url field in /md, /llm and /llm/job, sending the server's provider API key to an attacker-controlled host. A second flaw let LLMConfig resolve api_token=\"env:NAME\" from any server environment variable, so an attacker could read secrets such as SECRET_KEY, which can enable authentication bypass. The Docker API is unauthenticated by default.","solution":"Fixed: the LLM endpoints ignore a request-supplied base_url and derive the endpoint server-side from the provider name, and LLMConfig refuses env: resolution of protected variable names (containing SECRET/PASSWORD/PRIVATE, prefixes CRAWL4AI* and AWS_SECRET*, and SECRET_KEY, REDIS_PASSWORD, TOKEN). Workarounds: upgrade to the patched version, enable authentication via CRAWL4AI_API_TOKEN, and do not place sensitive secrets in the server environment alongside provider keys.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-f989-c77f-r2cq","publishedAt":"2026-06-16T21:00:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["data_extraction","other"],"issueType":"vulnerability","affectedPackages":["crawl4ai@<= 0.8.7 (fixed: 0.8.8)"],"affectedPackageNames":["crawl4ai"],"affectedPackageRefs":["pypi:crawl4ai"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["Crawl4AI","OpenAI API keys (OPENAI_API_KEY)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-f989-c77f-r2cq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-16T21:00:31.000Z","fixReleasedAt":"2026-06-04T01:38:34.672Z","daysToFix":-12,"fixCheckedAt":"2026-10-29T21:34:29.534Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"crawl4ai","fixedVersion":"0.8.8","matchedVersion":"0.8.8","fixReleasedAt":"2026-06-04T01:38:34.672Z","daysToFix":-12,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:29.386Z"}]}}