CVE-2026-109239 Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
Unauthenticated attackers can bypass egress controls to access internal services via blind SSRF in Crawl4AI's robots.txt parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109239?
CVE-2026-109239 is a medium-severity server-side request forgery vulnerability in unclecode crawl4ai, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.
Weakness: CWE-918
Which versions are affected by CVE-2026-109239?
How do I fix CVE-2026-109239?
No fix has been published for CVE-2026-109239 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-109239 being exploited?
There is no known exploitation of CVE-2026-109239 in the wild and no public exploit code.
Sources
Also known as GHSA-f77g-77vp-r96v, GHSA-qm8q-557r-p5w7.