Crawl4AI versions prior to 0.9.4 allow non‑admin clients to supply a wrapped LLMConfig that bypasses the untrusted‑config gate. The attacker can launder the payload so that environment‑variable references are interpreted by the server, leaking values such as SECRET_KEY and provider API keys. These secrets can be used to forge an admin JWT, granting full administrative control.

The vulnerability affects the unclecode crawl4ai package, versions 0.9.0 through 0.9.3 inclusive. Any deployment that exposes the /config/dump endpoint to non‑admin users is susceptible to this bypass.

The assigned CVSS score of 8.6 indicates a high‑risk flaw. No EPSS information is available, and the issue is not listed in the CISA KEV catalog, but the ability to read environment variables and forge admin credentials makes it highly valuable to attackers. Exploitation requires network access to the API endpoint and the ability to send a crafted request. The attack vector is remote, over HTTP/HTTPS, and does not require elevated privileges on the host.