p PatchFirst

CVE-2026-56259

CVE-2026-56259 · Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • crawl4ai

    Versions
    • ≥ 0, < 0.8.8: Affected (semver)
    • 0.8.8: Not affected (semver)

    Update to 0.8.8

  • crawl4ai PyPI

    Versions
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.71
    • 0.3.72
    • 0.3.73
    • 0.3.731
    • 0.3.74
    • 0.3.741
    • 0.3.742
    • 0.3.743
    • 0.3.744
    • 0.3.745
    • 0.3.746
    • 0.3.8
    • 0.4.0
    • 0.4.1
    • 0.4.21
    • 0.4.22
    • 0.4.23
    • 0.4.24
    • 0.4.241
    • 0.4.242
    • 0.4.243
    • 0.4.244
    • 0.4.245
    • 0.4.246
    • 0.4.247
    • 0.4.248
    • 0.4.248b3
    • 0.4.3b1
    • 0.4.3b2
    • 0.4.3b3
    • 0.5.0
    • 0.5.0.post1
    • 0.5.0.post2
    • 0.5.0.post3
    • 0.5.0.post4
    • 0.5.0.post5
    • 0.5.0.post6
    • 0.5.0.post7
    • 0.5.0.post8
    • 0.6.0
    • 0.6.0rc1
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.7.8
    • 0.8.0
    • 0.8.5
    • 0.8.6
    • 0.8.7
    Affected ranges
    • ECOSYSTEM: < 0.8.8

    Update to 0.8.8

Original sources

Check your server →