AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-f989-c77f-r2cq: Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseJune 16, 2026

Summary

Crawl4AI's Docker API server had two security flaws that let attackers steal secrets. First, attackers could change where the server sent LLM (large language model) requests by controlling a `base_url` parameter, causing the server to send its API keys to an attacker's server. Second, attackers could read any environment variable (including passwords and secret keys) from the server by using the `env:` syntax in configuration, then combine this with the first flaw to steal those secrets. Since the Docker API required no authentication by default, anyone could exploit these flaws.

Solution / Mitigation

Upgrade to the patched version. The fix prevents request-supplied `base_url` values from being used (the server now only derives the endpoint from its configured provider name), and blocks `env:` resolution of environment variables with names containing SECRET, PASSWORD, PRIVATE, or prefixes like CRAWL4AI* and AWS_SECRET*, or specific names like SECRET_KEY, REDIS_PASSWORD, and TOKEN. As workarounds, enable authentication with `CRAWL4AI_API_TOKEN` or avoid storing sensitive secrets in the server environment alongside provider keys.