Act nowDisclosed

Advisory · CVE-2026-109238

Crawl4AI link preview allows SSRF to internal and metadata addresses

Unauthenticated Crawl4AI API clients can enable link preview on crawl requests so the URL seeder fetches internal, private, and cloud metadata links from a controlled page and returns their parsed head data. Fixed in 0.9.4.

Advisory published October 12, 2026Independent summary
Vendor
Crawl4AI
Product
Crawl4AI
Identifier / CWE
CVE-2026-109238
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

You ask the crawler to fetch a page you control. Hidden links on that page point inside the building, and the crawler helpfully fetches those too and reads back what it found.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crawl requested

    An unauthenticated API client submits a crawl request with link preview configuration enabled.

  2. 02Controlled page supplied

    The client points the crawler at a page they control, with external-link inclusion and patterns set.

  3. 03Internal links fetched

    The URL seeder follows links from that page to internal, private, and cloud metadata addresses.

  4. 04Head data returned

    The parsed head data from those internal responses is returned to the client.

What happened

The Crawl4AI security advisory for CVE-2026-109238 covers Crawl4AI 0.7.0 before 0.9.4 and rates the flaw CVSS 3.1 8.6, CVSS 4.0 9.2.

An API client can enable link preview configuration on a crawl request. By supplying a controlled page with external links included and patterns set, the client makes the URL seeder fetch internal, private, and cloud metadata links and return their parsed head data. No authentication is required for the client.

Per the advisory record, 0.9.4 is the fixed release.

For Crawl4AI servers running with cloud identities, this is a path from a public crawling API to instance metadata and internal services.

What to do

  1. Inventory Crawl4AI API deployments and check each version.
  2. Upgrade affected deployments to Crawl4AI 0.9.4 or later.
  3. Disable link preview features or restrict API access to trusted clients until upgraded.
  4. Review crawl logs for requests whose pages linked to link-local, private, or metadata addresses.
  5. Determine which internal services and metadata endpoints were reachable from each server, and rotate any credentials that may have been read.
  6. Confirm the deployed version after upgrading.

Management note

A crawler is an SSRF machine by design; its safety depends entirely on destination controls. Any deployment that accepts crawl requests from untrusted clients should be treated as internet-facing infrastructure, not an internal convenience.