Crawl4AI before version 0.8.7 contains a server‑side request forgery (CWE‑918) flaw in the Docker API server’s /crawl/job and /llm/job accept webhook URLs without validating their target, allowing an attacker to force the server to issue requests to arbitrary internal services (e.g., 169.254.169.254). The vulnerability enables the attacker to exfiltrate internal data or cloud identity information, compromising confidentiality and potentially integrity of internal systems.

The affected product is Crawl4AI; all releases older than 0.8.7 that expose the Docker API server are vulnerable. The flaw permits attackers to without validating their destination, leading to requests to private internal IP ranges, Docker such as 169.254.169.254, potentially exposing sensitive internal data or cloud identity information. The weakness is classified as CWE‑918.

Attackers can trigger the vulnerable Docker API server to request internal resources, exposing sensitive data or cloud instance metadata. The high CVSS score of 9.2 reflects a full exploitation path with confidentiality, integrity, and availability impact. The EPSS score indicates that exploitation attempts are expected to be very rare today, but the vulnerability remains actionable because of the potential damage. The fact that it is not listed in CISA KEV does not mitigate the need for an urgent patch. Attackers would likely deliver malicious payloads over the network to the exposed /crawl/job or /llm/job endpoints, allowing traversal to private IP ranges and cloud metadata endpoints, potentially bypassing network segmentation.