Crawl4AI before 0.8.8 contains a credential exfiltration vulnerability in its Docker API server. The flaw allows attackers to redirect LLM API calls to attacker‑controlled endpoints by supplying a malicious base_url parameter and to read arbitrary environment variables by setting the api_token field to an env:VARIABLE_NAME string. The attacker can thus exfiltrate provider API keys and internal secrets such as the JWT SECRET_KEY used for authentication, effectively bypassing normal credential checks.

All Docker deployments of Crawl4AI using versions earlier than 0.8.8 that expose the /md, /llm, or /llm/job endpoints are vulnerable. The issue exists in the product’s API server component, and any publicly exposed or unprotected deployment is at risk.

The CVSS base score of 8.8 signals high severity. The EPSS score is below 1 %, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because authentication is not required to reach the vulnerable endpoints, an attacker can send crafted HTTP requests from any network location, redirecting requests to malicious addresses and reading secret data. The threat is greatest for services exposed directly to the internet or to untrusted users.