{"id":"CVE-2026-119122","kind":"vulnerability","aliases":["CVE-2026-119122"],"related":[],"title":"Crawl4AI: Docker server lets API clients reach internal and metadata addresses","description":"Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.","summary":"Crawl4AI before 0.9.5 has a blind server-side request forgery flaw in its Docker server. An API client can enable check_cache_freshness to bypass the egress proxy and make the server request internal or cloud-metadata addresses, which can reveal internal services.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crawl4ai","docker","package","python","self-hosted"],"not_affected_if":["no-untrusted-api-clients","not-running-docker-server"],"how_to_check":"- Check the installed Crawl4AI version, for example with `pip show crawl4ai`, and compare it to `0.9.5`.\n- Look for whether the Docker server is reachable by untrusted API clients and whether `check_cache_freshness` is accepted in requests.","fix":"- Crawl4AI: move to `0.9.5` or later.","status":"open","published_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:30:12+00:00","updated_at":"2026-10-29T16:30:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:30:12Z","model":"claude-haiku-5-5","output":{"fix":"- Crawl4AI: move to `0.9.5` or later.","reach":"network","title":"Crawl4AI: Docker server lets API clients reach internal and metadata addresses","impact":"medium","summary":"Crawl4AI before 0.9.5 has a blind server-side request forgery flaw in its Docker server. An API client can enable check_cache_freshness to bypass the egress proxy and make the server request internal or cloud-metadata addresses, which can reveal internal services.","audience":"businesses","category":"package","nicknames":[],"who_cares":["crawl4ai","docker","self-hosted","python"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Internal services and cloud metadata addresses get probed from the server","analyst_note":"","how_to_check":"- Check the installed Crawl4AI version, for example with `pip show crawl4ai`, and compare it to `0.9.5`.\n- Look for whether the Docker server is reachable by untrusted API clients and whether `check_cache_freshness` is accepted in requests.\n- unknown for anything beyond these checks.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-api-clients","not-running-docker-server"],"who_is_affected":"Teams that run the Crawl4AI Docker server and let API clients reach it can be affected, because the server makes outbound requests on their behalf. Exposure depends on the server being reachable by clients and on the check_cache_freshness path being used; deployments that do not expose the API to untrusted clients can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4160,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119122':14A,17A '-2026':13A,16A '0.9.5':27B,72C '302':111C 'address':11A,64B,122C 'allow':87C 'api':5A,42B,88C 'attack':100C 'blind':30B,75C 'bypass':50B,91C 'cach':47B,98C,102C 'cachevalid':108C 'check':46B,97C 'client':6A,43B,89C 'cloud':62B,120C 'cloud-metadata':61B,119C 'contain':73C 'control':104C 'crawl4ai':1A,18B,25B,70C 'cve':12A,15A 'discoveri':127C 'dns':114C 'docker':2A,19B,39B,84C 'egress':52B,93C 'enabl':45B,96C 'flaw':36B 'follow':110C 'forgeri':35B,80C 'fresh':48B,99C 'host':24B 'intern':8A,59B,68B,117C 'let':4A 'make':55B 'metadata':10A,63B,121C 'packag':20B 'port':124C 'proxi':53B,94C 'python':21B 'reach':7A 'rebind':115C 'redirect':112C 'request':34B,58B,79C 'reveal':67B 'self':23B 'self-host':22B 'server':3A,32B,40B,57B,77C,85C 'server-sid':31B,76C 'servic':69B,126C 'side':33B,78C 'trigger':107C 'url':105C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Crawl4AI Docker server and let API clients reach it can be affected, because the server makes outbound requests on their behalf. Exposure depends on the server being reachable by clients and on the check_cache_freshness path being used; deployments that do not expose the API to untrusted clients can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119122","severity":null,"published_at":"2026-10-29T16:18:04+00:00","modified_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}