Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Summary
The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.
Affected paths
/crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked:
browser_config.proxy_config.serverbrowser_config.proxy(deprecated field)crawler_config.proxy_config.server--proxy-server/--proxy-pac-url/--proxy-bypass-list/--host-resolver-rulesflags inbrowser_config.extra_args
Attack
An attacker sends /crawl with a benign, validation-passing URL but a proxy_config.server pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (results[0].html / cleaned_html / markdown). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.
Impact
Unauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.
Fix
Every proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not is_global, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from extra_args. A legitimate public proxy still works. Honors CRAWL4AI_ALLOW_INTERNAL_URLS.
Workarounds
- Upgrade to the patched version (0.8.9).
- Enable authentication (
CRAWL4AI_API_TOKEN). - Restrict the container's outbound network access (egress firewall / no metadata route).
Credits
Geo (geo-chen) - reported the proxy_config.server SSRF with a clear PoC.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | crawl4ai | < 0.8.9 | 0.8.9 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- Python (PyPI)
- Package
crawl4ai- Disclosed
- 16.06.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-588 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6qhc-x826-342c - CC BY 4.0
Vulnerability history: crawl4ai
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 12
- First → latest
- 04.2025 06.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 5
- Medium 1
Disclosures per year
- 2025: 1
- 2026: 11
-
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.