CVE-2026-56261: kidocode crawl4ai

csirt@kutim:~/threat-intel/cve/CVE-2026-56261

CVSS 7.5 · High EPSS 0,51%

Kerentanan Server-Side Request Forgery (SSRF) pada kidocode crawl4ai. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

Rincian

Terbit di NVD: 10 Juli 2026
Terakhir diubah: 13 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
kidocode	crawl4ai	Semua versi sebelum 0.8.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg mitigasi · advisory vendor
https://www.vulncheck.com/advisories/crawl4ai-server-side-request-forgery-via-webhook-urls product · advisory pihak ketiga
https://github.com/unclecode/crawl4ai product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.