CVE-2026-109238: Crawl4AI 0.9.4 Fixes CVSS 9.2 SSRF Letting API Users Reach Private Networks

Unclecode released version 0.9.4 of the Crawl4AI web scraping library to fix a critical server-side request forgery vulnerability identified as CVE-2026-109238. The flaw, rated 9.2 on the CVSS scale by the National Vulnerability Database, existed in all versions prior to this patch.

The vulnerability stems from how the library processes specific configuration options within API requests. According to the NVD record, attackers could exploit the link_preview_config parameter on /crawl endpoints to force the application to fetch internal resources. This mechanism allowed unauthorized access to private network addresses and cloud metadata services.

Technical Analysis of the Exploit

The attack vector relies on manipulating the AsyncUrlSeeder component within the Crawl4AI architecture. As described in the vulnerability details, an attacker supplies a controlled page with include_external and include_patterns settings enabled. This configuration tricks the seeder into retrieving links that point to internal or private infrastructure rather than public web content.

Once the AsyncUrlSeeder fetches these internal links, it returns the parsed head data to the requester. This behavior effectively bridges the gap between the external API client and the internal network environment. The weakness is classified under CWE-918, which covers server-side request forgery issues where the server is coerced into making unintended requests.

Affected Components and Users

The issue impacts any deployment of the unclecode crawl4ai package running versions earlier than 0.9.4. The vulnerability does not require complex exploitation steps beyond crafting specific request parameters. The NVD record confirms that the vulnerability allows API clients to reach internal addresses directly through the manipulated configuration options.

Cloud infrastructure users face heightened risk because the flaw can expose cloud-metadata links. The source material states that attackers can cause AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.

Defender's checklist

Security teams should immediately audit their Crawl4AI installations to verify the version number. Any instance running below 0.9.4 requires an update to mitigate the risk of internal network exposure. Organizations should also review their API access controls to ensure that untrusted clients cannot trigger crawl requests with preview configurations.

Background: Unauthorized access

Unauthorized access means any entry into a system, network, or physical space by a person who lacks explicit permission. It occurs when attackers bypass identity verification or exploit misconfigurations. You stop it by enforcing least privilege, monitoring logs for anomalies, and separating administrative duties from daily operations.

Read the full guide: Unauthorized Access Meaning: How Intruders Bypass Controls

What to do and how to stay safe: Crawl4AI

• Verify the installed version of Crawl4AI and upgrade to 0.9.4 or later if currently running an older release.
• Restrict API access to trusted internal networks or authenticated users to prevent unauthorized SSRF attempts.
• Monitor server logs for unusual requests containing link_preview_config parameters or unexpected internal IP resolutions.
• Review firewall rules to block outbound traffic from scraping services to known cloud metadata endpoints.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109238?

The National Vulnerability Database rates the severity of CVE-2026-109238 as 9.2, which is considered critical.

Which versions of Crawl4AI are affected by this vulnerability?

All versions of the unclecode crawl4ai library prior to version 0.9.4 are affected by this server-side request forgery flaw.

How do attackers exploit this vulnerability?

Attackers exploit the flaw by enabling link_preview_config on /crawl requests and setting include_external and include_patterns to fetch internal links.