9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-56266

CVE-2026-56266: Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-56266

CVE-2026-56266:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
crawl4ai	pip	<= 0.8.6	0.8.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commits between the vulnerable version (<= 0.8.6) and the patched version (0.8.7) of crawl4ai revealed multiple critical vulnerabilities. The root causes stem from insufficient input validation and lack of security controls across several API endpoints.

Path Traversal (File Write): The /screenshot and /pdf endpoints used the output_path parameter to write files. The lack of validation on this path allowed an attacker to use ../ sequences to write files to arbitrary locations on the filesystem, as seen in the generate_screenshot and generate_pdf functions in deploy/docker/server.py.
Server-Side Request Forgery (SSRF): Multiple endpoints were vulnerable to SSRF. The /crawl/job and /llm/job endpoints accepted unvalidated webhook URLs (llm_job_enqueue, crawl_job_enqueue). The primary crawling endpoints (/crawl, /md, /llm) also accepted unvalidated target URLs (handle_llm_qa, handle_markdown_request, create_new_task, handle_crawl_request). Furthermore, the initial SSRF fix was incomplete and could be bypassed using IPv6-mapped IPv4 addresses, a flaw in the validate_webhook_url function itself.
Authentication Bypass: The entire monitoring dashboard, including destructive actions, was left without authentication because the FastAPI router was included without the necessary dependency (app.include_router(monitor_router) in server.py). The WebSocket endpoint (websocket_endpoint) also lacked a token check.
Stored Cross-Site Scripting (XSS): The monitoring functions track_request_start and track_request_end stored raw, unescaped user input (URLs and error messages) which were then rendered on the dashboard, leading to stored XSS.
Code Execution & Hardcoded Secrets: The /execute_js endpoint permitted arbitrary JavaScript execution by design and was enabled by default. A hardcoded JWT secret (SECRET_KEY = ... "mysecret") in deploy/docker/auth.py allowed anyone to forge authentication tokens.

The identified vulnerable functions are the specific entry points or processing functions where this lack of validation occurred. Exploitation of these functions would leave clear indicators in runtime profiles and logs, matching the function names and file paths provided.

Vulnerable functions

generate_screenshot

deploy/docker/server.py

The function accepts a user-provided 'output_path' and writes a file to that path without sufficient validation. An attacker could use path traversal sequences (e.g., '../../') to write files to arbitrary locations on the server's filesystem, leading to denial of service or potentially remote code execution.

generate_pdf

deploy/docker/server.py

llm_job_enqueue

deploy/docker/job.py

The function accepted a webhook URL from the user without validation. This URL was later used to send a request, allowing an attacker to specify internal network addresses or cloud metadata endpoints, leading to Server-Side Request Forgery (SSRF).

crawl_job_enqueue

deploy/docker/job.py

websocket_endpoint

deploy/docker/monitor_routes.py

The WebSocket endpoint for real-time monitoring did not perform any authentication checks, allowing any unauthenticated user to connect and receive monitoring data. The fix adds an explicit token check from the query parameters.

track_request_start

deploy/docker/monitor.py

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.