Skip to content
AI Sec Watch
HighVulnerability

GHSA-4qqr-vv2q-cmr5: Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-53754GHSA-4qqr-vv2q-cmr5
Published
Record updated
View JSON
Affected
  • crawl4ai <= 0.8.7
Fixed in
0.8.8
  • released June 3, 2026, 12 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.4%

Summary

Crawl4AI's Docker API server used an incomplete IPv4/IPv6 CIDR blocklist in its SSRF protection (validate_webhook_url and validate_url_destination in deploy/docker/utils.py), affecting crawl and webhook URLs. An unauthenticated attacker, since jwt_enabled defaults to false, could reach internal services and cloud metadata endpoints such as 169.254.169.254 by encoding that address in NAT64, 6to4, IPv4-mapped or IPv4-compatible IPv6 forms, or by using the IPv6 unspecified address.

Mitigation

The blocklist is replaced by a rule that rejects any resolved IP where not ip.is_global, applied to the address and every embedded IPv4 transition form, and error messages no longer echo the resolved IP. Workarounds: upgrade to the patched version, enable authentication (CRAWL4AI_API_TOKEN), and restrict the container's outbound network access (egress firewall / no metadata route).

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • crawl4aiPyPILLM dependency since 2024-09-25 · 4 tracked dependents

Related items