CVE-2026-57573
- Source
- https://cve.org/CVERecord?id=CVE-2026-57573
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57573.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-57573
- Aliases
- Published
- 2026-07-06T20:11:15.691Z
- Modified
- 2026-07-09T04:02:36.041214780Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
- Details
-
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handlestreamcrawlrequest passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawlerconfig.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57573.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ] }- References
Affected packages
Git / github.com/unclecode/crawl4ai
Affected ranges
- Type
- GIT
- Repo
- https://github.com/unclecode/crawl4ai
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "0.9.0" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
0.*
0.3.4
docker-rebuild-v0.*
docker-rebuild-v0.8.6
docker-rebuild-v0.8.7
docker-rebuild-v0.8.8
docker-rebuild-v0.8.9
v.*
v.3.72
v0.*
v0.0.75
v0.1.0
v0.2.0
v0.2.1
v0.2.4
v0.2.6
v0.2.7
v0.2.71
v0.2.72
v0.2.73
v0.2.74
v0.2.77
v0.3.0
v0.3.3
v0.3.6
v0.3.745
v0.4.24
v0.4.243
v0.5.0.post1
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.6
v0.8.7
v0.8.8
v0.8.9
vr0.*
vr0.6.0
vr0.6.0rc1
vr0.6.3