Crawl4AI SSRF Flaw CVSS 9.2 Exposes Internal Cloud Metadata to API Users

The National Vulnerability Database lists CVE-2026-109238 as a critical security flaw affecting the Crawl4AI library. This server-side request forgery issue impacts all versions released before 0.9.4. The vulnerability allows external API clients to bypass standard network restrictions. Attackers can use this gap to reach internal addresses that should remain isolated from public access.

How does the vulnerability work?

The flaw exists within the link preview configuration feature of the Crawl4AI software. When attackers send requests to the /crawl endpoint, they can enable specific settings that trigger unintended data retrieval. By supplying a controlled page with include_external and include_patterns set, they manipulate the AsyncUrlSeeder component. This causes the system to fetch links from internal, private, and cloud-metadata sources.

What data is at risk?

The exploitation allows the attacker to extract parsed head data from these restricted links. This includes sensitive information hosted on internal servers or cloud infrastructure metadata. The National Vulnerability Database classifies the weakness as CWE-918. The high severity score of 9.2 reflects the potential for significant data exposure. Internal network boundaries are effectively bypassed through this mechanism.

Who is affected by this issue?

The vulnerability impacts users of the Crawl4AI library developed by unclecode. Any deployment running versions before 0.9.4 is considered vulnerable according to the NVD record. Organizations relying on this library for web scraping tasks face immediate risk. The flaw allows API clients to initiate requests that traverse into private network segments. This exposes infrastructure details that should remain confidential.

What is the current status?

The National Vulnerability Database provides the technical details of the flaw. The record specifies the affected version range and the nature of the server-side request forgery. It does not confirm the availability of a patch or update. Users must verify their current version against the 0.9.4 threshold. No official fix has been confirmed in the provided source material.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Crawl4AI

• Audit your infrastructure to identify any systems running Crawl4AI versions prior to 0.9.4.
• Monitor network logs for unusual outbound connections from scraping services to internal IP ranges.
• Restrict API access to the /crawl endpoint to trusted internal clients only.
• Disable link preview configurations unless explicitly required for your application logic.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109238?

It is a critical server-side request forgery vulnerability in Crawl4AI versions before 0.9.4.

What is the CVSS score for this flaw?

The National Vulnerability Database assigns a CVSS score of 9.2 to this vulnerability.

Can attackers access cloud metadata through this bug?

Yes, attackers can cause AsyncUrlSeeder to fetch and return parsed head data from cloud-metadata links.