---
id: "CVE-2026-112363"
kind: "vulnerability"
aliases: ["CVE-2026-112363"]
title: "Crawl4AI: unauthenticated SSRF in Docker API probes internal hosts"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "crawl4ai", "docker", "python", "self-hosted"]
not_affected_if: ["library-only-use", "no-docker-api-server"]
published_at: "2026-10-19T16:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112363", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Crawl4AI: unauthenticated SSRF in Docker API probes internal hosts

Crawl4AI versions 0.8.7 through 0.9.5 have a server-side request forgery flaw in their Docker API server. An unauthenticated attacker can send crafted URLs with userinfo that bypass destination checks, making the server connect to internal hosts on port 443 and leak certificate details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Crawl4AI version with `pip show crawl4ai` or the image tag used in your Docker deployment.
- Check whether the Docker API server is reachable from untrusted networks, since the sources do not say whether a default config exposes it.

## Fix

- Upgrade Crawl4AI to a version later than `0.9.5`; the sources do not name the patched release.
- Until patched, block the Crawl4AI Docker API from untrusted networks and restrict outbound access from its container to internal hosts.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112363

## From the sources

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_