CVE-2026-56259

Katalog CVE

CVSS 8.2 · High EPSS 0,43%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada kidocode crawl4ai. Skor CVSS 3.1 8.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass.

Rincian

Terbit di NVD

12 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f989-c77f-r2cq advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/crawl4ai-llm-credential-exfiltration-via-base-url-and-environment-variabl... advisory pihak ketiga