External risk intelligence

Crawl4AI Server-Side Request Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-109238

Crawl4AI is designed as an API-based web crawling and scraping service. Such tools are commonly deployed as internet-facing services or gateways to facilitate data extraction from public web sources, making the API endpoints accessible for incoming requests in typical production environments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Crawl4AI, a web crawling and scraping tool. The issue allows external attackers to trick the system into accessing internal network resources by manipulating preview configurations. This could potentially expose sensitive information or internal systems.

Allows attackers to access internal systems.
Understand potential exposure of internal resources.
Assess relevance to understand your specific risk.

Attack Path

How an attacker could exploit the issue

An attacker with network access can exploit this vulnerability by sending a specially crafted request to the crawl API. This request allows them to manipulate the link preview configuration to include internal, private, or cloud-metadata addresses. The system then fetches data from these unintended locations, potentially exposing sensitive information.

Network access is required.
Crafted API request triggers vulnerability.
Exposes internal and sensitive data.

Live Threat

Current exploitation, exposure, and threat context

When link preview is enabled on crawl requests, an attacker could trick the system into requesting internal, private, or cloud-metadata links and returning their parsed head data. This could expose sensitive information contained within these internal network resources.

Internal network resources could be exposed.
API clients could trigger requests to internal addresses.
Sensitive internal data may be revealed.

Operational Fix

Recommended remediation, mitigation, and detection steps

The server-side request forgery vulnerability in Crawl4AI exposes internal and cloud-metadata links through its API. This impacts organizations using Crawl4AI for web crawling and scraping, potentially affecting application owners, platform teams, and security operations. The first practical step involves identifying all instances of Crawl4AI, assessing their reachability and business criticality, and then assigning ownership for remediation planning.

Application and platform teams own resolution.
Verify external access and critical business use.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Crawl4AI?

Crawl4AI is an open-source tool designed for web crawling and scraping. Developers use it as an API-based service to automate data extraction from websites. It simplifies complex tasks like parsing HTML and capturing page metadata, often serving as a gateway or engine that processes requests to fetch content from the internet for various data-driven applications.

What does Server-Side Request Forgery mean for CVE-2026-109238?

This vulnerability is classified as CWE-918, or Server-Side Request Forgery (SSRF). In the context of CVE-2026-109238, it means the software can be tricked into acting as a proxy. Instead of crawling only intended public websites, the server can be manipulated to send requests to private internal network addresses or sensitive cloud metadata services, returning the results of those requests back to the attacker.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the crawl API. Specifically, they must enable the 'link_preview_config' feature and configure settings like 'include_external' and 'include_patterns' to point toward internal targets. If this feature is disabled or not in use, the specific code path that misdirects the server to private resources is not activated.

Do I need to worry if my Crawl4AI instance is internal?

According to Halo Surface Signal, Crawl4AI is typically designed for public-facing data extraction. If your instance is exposed to the internet, it is at higher risk because remote attackers can reach your API. While internal-only deployments reduce the threat from external actors, they still face risks if an attacker gains initial network access or if unauthorized users can reach the API endpoint.

How should I respond to CVE-2026-109238?

Start by identifying all instances of Crawl4AI running in your environment. Evaluate whether they are reachable from the network and determine their business function. Since this flaw is tied to specific API configurations, prioritize updating your software versions to those where this issue is resolved, and coordinate with your platform teams to ensure remediation is applied to all active services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.