python · crawl4aiCritical
crawl4ai Docker API SSRF vulnerability in streaming crawl endpoints
The Docker API server's streaming crawl endpoints (`/crawl/stream` and `/crawl` with `stream=true`) lacked SSRF destination validation, allowing unauthenticated read SSRF.
What changed
The Docker API server's streaming crawl endpoints (`/crawl/stream` and `/crawl` with `stream=true`) lacked SSRF destination validation, allowing unauthenticated read SSRF. The fix adds destination validation to the streaming handler.
Who it affects
Users running the crawl4ai Docker API without authentication or network restrictions, especially those exposing the API to untrusted networks.
What to do today
Upgrade to version 0.9.0 or apply workarounds: enable authentication, restrict API access, or limit container outbound network.
The trail
Collected→
Audited→
Written→
Published