External risk intelligence

Crawl4AI Docker API Unauthenticated Remote Code Execution Via Hooks Parameter

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-26216

The vulnerability resides in a web endpoint designed to receive requests, typical of an API or service interface. Since the /crawl endpoint is intended to perform web crawling tasks and is exposed as part of a Docker deployment, it is commonly accessible as an internet-facing service or API component in typical web application architectures.

Code Injection

Kidocode Crawl4ai

before 0.8.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Crawl4AI, a technology that helps process and analyze web content, related to its Docker API deployment. This issue allows for unauthenticated remote code execution, meaning attackers could potentially gain full control of affected servers, access sensitive data, and move within internal networks. The main concern is confirming if this specific technology is in use and exposed.

Code execution flaw in web crawling tool.
Confirms exposure and relevance for leadership.
Assess use of this technology in your environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can send a crafted request to the `/crawl` endpoint, which processes a `hooks` parameter. This parameter allows for the inclusion of Python code that is executed using `exec()`. Because the `__import__` function is permitted, attackers can import any Python module and execute system commands, leading to full server compromise.

Entry condition: Exposed Docker API deployment.
Trigger point: `/crawl` endpoint's `hooks` parameter.
Resulting risk: Full server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected server by sending specially crafted requests to the `/crawl` endpoint. This could lead to the compromise of the entire server, including unauthorized access to sensitive data and disruption of services.

Server compromise and data exfiltration.
Unauthenticated network requests.
Full server control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Crawl4AI's Docker API allows unauthenticated remote code execution. Infrastructure or platform teams managing Docker deployments are likely responsible for addressing this, beginning with an inventory of where Crawl4AI is deployed and whether these instances are internet-facing or accessible to unauthorized users. Confirming the business criticality and accountable owner will inform remediation prioritization, potentially involving vendor coordination or temporary risk reduction measures.

Platform/Infrastructure teams own the fix.
Verify internet-facing Crawl4AI instances.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Crawl4AI?

Crawl4AI is a software tool designed to process and analyze web content. Users typically integrate it into their systems to automate web scraping and data extraction workflows, often deploying it via Docker containers for scalable execution.

What does CVE-2026-26216 mean for the software?

This CVE identifies a critical flaw categorized as Improper Control of Generation of Code (CWE-94). The application insecurely processes user-supplied input by passing a specific parameter directly to an execution function. This allows an attacker to run arbitrary system commands, effectively granting them control over the underlying server.

How is this vulnerability triggered?

The issue is triggered when an attacker sends a malicious request to the /crawl endpoint. By manipulating the hooks parameter, they can bypass security restrictions. Note that this flaw requires the use of the Docker API deployment; standard configurations that do not expose this specific endpoint or process these parameters are not subject to this trigger path.

Why should I care about this vulnerability?

If you run Crawl4AI in a Docker container, your environment is at risk. Halo Surface Signal notes that because the /crawl endpoint is designed for web-based requests, it is frequently exposed to the internet. If your instance is reachable by unauthorized users, they could exploit this flaw to gain full access to your server, read sensitive files, or move laterally into your internal network.

How do I respond if I am using Crawl4AI?

First, conduct an inventory to locate all active Docker deployments of Crawl4AI in your infrastructure. Determine if these instances are accessible from the internet or by unauthorized internal users. Prioritize these identified systems for updates or isolation, and coordinate with your platform or infrastructure teams to apply the vendor-recommended security patches to resolve the underlying code execution risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.