CVE-2026-56261Crawl4AI - Server-Side Request Forgery via Webhook URLs

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

9.2 CRITICALEPSS 0.51%Not in KEVNVD: Analyzed

Last updated: 2026-11-08 14:05 UTC

OverviewCVSS details

9.2CRITICALCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Analyzed
Published: Jul 10, 2026
Assigner: VulnCheck

Affected

Crawl4AI (Crawl4AI)

Versions: before 0.8.7
Fixed in: 0.8.7

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 8

0.51%chance of exploitation in 30 days

Higher than 43.97% of CVEs

CVSS 4.0 · VulnCheck (CNA)

9.2Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: None
Availability impact: None
Confidentiality (other systems): High
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

8.6High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.2	CRITICAL	4.0VulnCheck (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
8.6	HIGH	3.1VulnCheck (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CVE ID: CVE-2026-56261
Status: Analyzed
Assigner (CNA): VulnCheck
Published: Jul 10, 2026
Last modified: 2026-11-08 14:05 UTC
Weaknesses: CWE-918 · Server-Side Request Forgery (SSRF)

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 10:38 UTC.