The vulnerability in Crawl4AI versions 0.8.7 through 0.9.5 causes a server‑side request forgery (SSRF). An unauthenticated attacker can enable the fetch_ssl_certificate flag and supply a crafted URL containing userinfo to bypass destination checks. The SSLCertificate.from_url method then connects to an internal host on port 443, revealing reachability and certificate details, which can aid further exploitation. This flaw is a CWE‑918 type vulnerability.

Affected products are the Crawl4AI crawler library released by unclecode. Versions 0.8.7 up to and including 0.9.5 are impacted. No fixed version is supplied in the data.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the Docker API server accepts unauthenticated requests, the attack vector is simple and could be executed from any network that can reach the API endpoint. The ability to reach internal hosts and retrieve certificate details may give an attacker leverage for further reconnaissance or exploitation within the internal network.