Skip to content
AI Sec Watch
HighVulnerabilityLLM-specific

GHSA-f989-c77f-r2cq: Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-f989-c77f-r2cq
Published
Record updated
View JSON
Affected
  • crawl4ai <= 0.8.7
Fixed in
0.8.8
  • released June 3, 2026, 12 days before disclosure

Summary

The Docker API server of Crawl4AI let requests control the LLM endpoint through the base_url field in /md, /llm and /llm/job, sending the server's provider API key to an attacker-controlled host. A second flaw let LLMConfig resolve api_token="env:NAME" from any server environment variable, so an attacker could read secrets such as SECRET_KEY, which can enable authentication bypass. The Docker API is unauthenticated by default.

Mitigation

Fixed: the LLM endpoints ignore a request-supplied base_url and derive the endpoint server-side from the provider name, and LLMConfig refuses env: resolution of protected variable names (containing SECRET/PASSWORD/PRIVATE, prefixes CRAWL4AI* and AWS_SECRET*, and SECRET_KEY, REDIS_PASSWORD, TOKEN). Workarounds: upgrade to the patched version, enable authentication via CRAWL4AI_API_TOKEN, and do not place sensitive secrets in the server environment alongside provider keys.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • crawl4aiPyPILLM dependency since 2024-09-25 · 4 tracked dependents

Related items