CVE-2026-109237: falha de alta gravidade em unclecode crawl4ai
Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
unclecode · crawl4aiCVEs relacionadas — unclecode crawl4ai
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53753CRITICALCrawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker APIEPSS 2.9%CVE-2026-53755HIGHCrawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF checkEPSS 1.6%CVE-2026-57572CRITICALCrawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argsEPSS 0.9%CVE-2026-57571CRITICALCrawl4AI arbitrary file write via download filename path traversalEPSS 0.8%CVE-2026-91941HIGHCrawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategyEPSS 0.5%CVE-2026-91940HIGHcrawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategyEPSS 0.5%