PT-2026-50166 · Pypi · Crawl4Ai

Published

2026-06-16

·

Updated

2026-06-16

·

CVE-2026-53755

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.

Affected paths

/crawl, /crawl/stream, and /crawl/job accept a browser config (and crawler config). The following all feed Chromium's egress and were unchecked:
  • browser config.proxy config.server
  • browser config.proxy (deprecated field)
  • crawler config.proxy config.server
  • --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser config.extra args

Attack

An attacker sends /crawl with a benign, validation-passing URL but a proxy config.server pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (results[0].html / cleaned html / markdown). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.

Impact

Unauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.

Fix

Every proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not is global, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from extra args. A legitimate public proxy still works. Honors CRAWL4AI ALLOW INTERNAL URLS.

Workarounds

  • Upgrade to the patched version (0.8.9).
  • Enable authentication (CRAWL4AI API TOKEN).
  • Restrict the container's outbound network access (egress firewall / no metadata route).

Credits

Geo (geo-chen) - reported the proxy config.server SSRF with a clear PoC.

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-53755
GHSA-6QHC-X826-342C

Affected Products

Crawl4Ai