Crawl4AI’s Docker API server did not validate the destination URL when the streaming path was invoked, allowing an unauthenticated attacker to send POST requests to /crawl/stream or to /crawl with crawler_config.stream=true and supply a URL that resolves to an internal, private, or link‑local address. The server resolved and fetched that URL, streaming the response back to the attacker. The flaw is a server‑side request forgery (CWE‑918) that grants remote callers the ability to read internal resources, files, or services that would normally be unreachable from outside the host. The CVSS score of 8.6 indicates high severity for unauthenticated remote attackers, and the EPSS score of < 1 % suggests limited current exploitation activity, although the vulnerability remains theoretically exploitable.

Any installation of the open‑source Crawl4AI web crawler produced by unclecode with a version earlier than 0.9.0 is affected by the streaming endpoint SSRF flaw. This includes releases 0.8.x and earlier. Version 0.9.0 introduces destination validation for both streaming and non‑streaming paths, mitigating the vulnerability.

The high CVSS score reflects serious potential impact: an attacker can obtain the contents of internal services, files, or databases reachable only within the host’s network. Exploitation requires no credentials and only a reachable POST request to a documented API endpoint, making it trivially usable by any external actor who can reach the server. The flaw remains theoretically exploitable today—though the low EPSS score suggests it has not yet been widely abused, and it is not listed in the CISA KEV catalog. The principal risk is the uncontrolled internal network exposure, which could enable attackers to pivot, exfiltrate data, or disrupt services. Organizations should treat this as a critical server‑side request forgery that must be mitigated promptly.