CVE-2026-57573 Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
Unauthenticated attackers can exploit missing SSRF checks in the streaming endpoint to access internal network resources via the Crawl4AI Docker server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57573?
CVE-2026-57573 is a high-severity server-side request forgery vulnerability in unclecode crawl4ai, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-57573?
3 open source packages ship an affected version, including crawl4ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
crawl4ai PyPI | All versions | 0.9.0 |
crawl4ai PyPI | All versions | 0.9.0 |
crawl4ai PyPI | All versions | 0.9.0 |
Products include Kidocode Crawl4ai.
How do I fix CVE-2026-57573?
Upgrade crawl4ai to 0.9.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-57573 being exploited?
There is no known exploitation of CVE-2026-57573 in the wild and no public exploit code.
Other vulnerabilities in unclecode crawl4ai
- CVE-2026-57572 Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
- CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
- CVE-2026-53753 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
- CVE-2026-57571 Crawl4AI arbitrary file write via download filename path traversal
- CVE-2026-56265 Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Sources
Also known as GHSA-wm69-2pc3-rmmf, PYSEC-2026-2140.