8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53755

CVE-2026-53755: Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default. /crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked: browser_config.proxy_config.server, browser_config.proxy (deprecated field), crawler_config.proxy_config.server, and --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser_config.extra_args. This vulnerability is fixed in 0.8.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53755

CVE-2026-53755:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
crawl4ai	pip	<= 0.8.8	0.8.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the crawl4ai Docker API server, identified as GHSA-6qhc-x826-342c. The root cause is the failure to validate user-supplied proxy server configurations in requests to the /crawl, /crawl/stream, and /crawl/job endpoints. An attacker could craft a request with a valid crawl URL but specify a proxy server pointing to an internal IP address, bypassing the server's destination checks and gaining access to internal network resources, such as cloud metadata services.

The analysis of the patch commit cdf2ead7ed4b78594d06b87bae930a819c685825 shows that the functions handle_crawl_request and handle_stream_crawl_request in deploy/docker/api.py are the main entry points for the vulnerable operations. Before the fix, these functions would accept browser_config and crawler_config objects from the user and initiate a browser-based crawl without inspecting the proxy settings within them. The patch rectifies this by adding a call to a new function, _enforce_proxy_safety, at the beginning of both handle_crawl_request and handle_stream_crawl_request. This new function, defined in the same file, is responsible for validating all possible proxy configurations (browser_config.proxy, browser_config.proxy_config.server, crawler_config.proxy_config.server) and scrubbing dangerous proxy-related command-line arguments from extra_args. Because handle_crawl_request and handle_stream_crawl_request are the functions that receive and process the malicious input, they are the key functions that would appear in a runtime profile during exploitation.

Vulnerable functions

handle_crawl_request

deploy/docker/api.py

This function handles crawl requests for the `/crawl` and `/crawl/job` endpoints. Prior to the patch, it did not validate the proxy server configuration supplied by the user in `browser_config` or `crawler_config`. An attacker could specify a proxy pointing to an internal network, leading to a Server-Side Request Forgery (SSRF) vulnerability. The fix introduces the `_enforce_proxy_safety` function call to validate these settings before initiating the crawl.

handle_stream_crawl_request

deploy/docker/api.py

This function handles streaming crawl requests for the `/crawl/stream` endpoint. Prior to the patch, it did not validate the proxy server configuration supplied by the user in `browser_config` or `crawler_config`. An attacker could specify a proxy pointing to an internal network, leading to a Server-Side Request Forgery (SSRF) vulnerability. The fix introduces the `_enforce_proxy_safety` function call to validate these settings before initiating the crawl.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.