CVE-2026-53754

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53754

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53754.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53754

Aliases

Published

2026-06-23T18:16:34.260Z

Modified

2026-07-08T08:13:46.828797022Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

Details

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validatewebhookurl / validateurldestination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 169.254.169.254) despite the filter by encoding an internal IPv4 address inside an IPv6 transition form, or by using the IPv6 unspecified address. Because the Docker API is unauthenticated by default (jwt_enabled: false), no credentials are required. This vulnerability is fixed in 0.8.8.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53754.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/unclecode/crawl4ai

Affected ranges

Type

GIT

Repo

https://github.com/unclecode/crawl4ai

Events

Introduced

Fixed

930dc0a61fe65c1e063df05792ffdf971d074674

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.8"
        }
    ]
}

Affected versions

0.*

0.3.4

docker-rebuild-v0.*

docker-rebuild-v0.8.6

docker-rebuild-v0.8.7

v.*

v.3.72

v0.*

v0.0.75

v0.1.0

v0.2.0

v0.2.1

v0.2.4

v0.2.6

v0.2.7

v0.2.71

v0.2.72

v0.2.73

v0.2.74

v0.2.77

v0.3.0

v0.3.3

v0.3.6

v0.3.745

v0.4.24

v0.4.243

v0.5.0.post1

v0.6.3

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.6

v0.8.7

vr0.*

vr0.6.0

vr0.6.0rc1

vr0.6.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53754.json"