CVE-2026-57573

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.

• CWE-918

• https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2Patch
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmfMitigation, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5754Reflected Cross-Site Scripting (XSS) Vulnerability in Radwar…6.1
• CVE-2026-5755Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5…6.5
• CVE-2026-5756Unauthenticated Configuration File Modification Vulnerabilit…7.5
• CVE-2026-5757Unauthenticated remote information disclosure vulnerability …7.5
• CVE-2026-57571Crawl4AI is an open-source LLM-friendly web crawler and scra…9.6
• CVE-2026-57572Crawl4AI is an open-source LLM-friendly web crawler and scra…10
• CVE-2026-57574Misskey is an open source, federated social media platform. …7.4
• CVE-2026-57575Misskey is an open source, federated social media platform. …6.9
• CVE-2026-5758JavaScript is vulnerable to prototype pollution in Mafintosh…6.5
• CVE-2026-57584Phalcon is a high-performance, full-stack PHP framework. Pri…8.7
• CVE-2026-57585MessagePack is the serializer implementation for Python msgp…7.5
• CVE-2026-57587A SQL injection vulnerability in Nessus allows a remote, una…5.3