{"id":"CVE-2026-53755","title":"Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check","summary":"Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check","severity":"high","cvss":8.6,"cwe":["CWE-918"],"vendor":"crawl4ai","product":"crawl4ai","ecosystem":"pip","affected":["crawl4ai <= 0.8.8"],"patched":["crawl4ai 0.8.9"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6qhc-x826-342c","references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-6qhc-x826-342c"},{"url":"https://github.com/advisories/GHSA-6qhc-x826-342c"}],"tags":["ghsa","pip","exploit-available"],"epss":0.01577,"epssPercentile":0.7441,"ingestedAt":"2026-06-29T14:31:47.692Z","exploits":{"nuclei":["CVE-2026-53755"],"checkedAt":"2026-09-24T07:53:06.677Z"},"exploitAvailable":true,"slug":"CVE-2026-53755","body":"## Overview\n\n### Summary\n\nThe Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.\n\n### Affected paths\n\n`/crawl`, `/crawl/stream`, and `/crawl/job` accept a `browser_config` (and `crawler_config`). The following all feed Chromium's egress and were unchecked:\n- `browser_config.proxy_config.server`\n- `browser_config.proxy` (deprecated field)\n- `crawler_config.proxy_config.server`\n- `--proxy-server` / `--proxy-pac-url` / `--proxy-bypass-list` / `--host-resolver-rules` flags in `browser_config.extra_args`\n\n### Attack\n\nAn attacker sends `/crawl` with a benign, validation-passing URL but a `proxy_config.server` pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (`results[0].html` / `cleaned_html` / `markdown`). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.\n\n### Impact\n\nUnauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.\n\n### Fix\n\nEvery proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not `is_global`, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from `extra_args`. A legitimate public proxy still works. Honors `CRAWL4AI_ALLOW_INTERNAL_URLS`.\n\n### Workarounds\n\n- Upgrade to the patched version (0.8.9).\n- Enable authentication (`CRAWL4AI_API_TOKEN`).\n- Restrict the container's outbound network access (egress firewall / no metadata route).\n\n### Credits\n\nGeo ([geo-chen](https://github.com/geo-chen)) - reported the proxy_config.server SSRF with a clear PoC.\n\n## Affected packages\n\n- `crawl4ai <= 0.8.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `crawl4ai 0.8.9`","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":47.3,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":5328,"id":"CVE-2026-53755","ts":1788887266336,"field":"exploit_available","old":"false","new":"true"},{"seq":4211,"id":"CVE-2026-53755","ts":1788886381035,"field":"exploit_available","old":"true","new":"false"},{"seq":2970,"id":"CVE-2026-53755","ts":1788883045909,"field":"exploit_available","old":"false","new":"true"},{"seq":1999,"id":"CVE-2026-53755","ts":1788882450155,"field":"exploit_available","old":"true","new":"false"},{"seq":1075,"id":"CVE-2026-53755","ts":1788881886408,"field":"exploit_available","old":"false","new":"true"}]}