CVE-2026-26216
📋 TL;DR
Crawl4AI versions before 0.8.0 contain an unauthenticated remote code execution vulnerability in the Docker API deployment. Attackers can send malicious Python code via the /crawl endpoint's hooks parameter, which gets executed with exec() and allows importing arbitrary modules to run system commands. This affects all deployments using vulnerable versions of Crawl4AI's Docker API.
💻 Affected Systems
- Crawl4AI
📦 What is this software?
Crawl4ai by Kidocode
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing arbitrary command execution, sensitive data exfiltration, file system access, and lateral movement within internal networks.
Likely Case
Remote attackers gain shell access to the container/host, install persistence mechanisms, and steal sensitive data.
If Mitigated
If properly patched and network-restricted, impact is limited to denial of service or limited data exposure.
🎯 Exploit Status
Exploitation requires only HTTP requests with malicious Python code in hooks parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.0
Vendor Advisory: https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp
Restart Required: Yes
Instructions:
1. Update Crawl4AI to version 0.8.0 or later. 2. Rebuild and redeploy Docker containers. 3. Verify the hooks parameter no longer accepts arbitrary Python code.
🔧 Temporary Workarounds
Network Restriction
linuxRestrict access to Crawl4AI Docker API endpoints using firewall rules or network policies.
iptables -A INPUT -p tcp --dport [CRAWL4AI_PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [CRAWL4AI_PORT] -j DROP
Docker Network Isolation
linuxRun Crawl4AI container on isolated Docker network with no external exposure.
docker network create --internal crawl4ai-network
docker run --network crawl4ai-network crawl4ai
🧯 If You Can't Patch
- Immediately restrict network access to only trusted IP addresses using firewall rules.
- Monitor logs for suspicious requests to /crawl endpoint with hooks parameter containing Python code.
🔍 How to Verify
Check if Vulnerable:
Check if running Crawl4AI version <0.8.0 in Docker deployment with /crawl endpoint accessible.Check Version:
docker exec [container_name] python -c "import crawl4ai; print(crawl4ai.__version__)"Verify Fix Applied:
Confirm version is 0.8.0+ and test that hooks parameter no longer executes arbitrary Python code.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /crawl with hooks parameter containing import statements or system commands
- Unusual process execution from Crawl4AI container
Network Indicators:
- Outbound connections from Crawl4AI container to unexpected destinations
- Large data exfiltration from container
SIEM Query:
source="crawl4ai" AND (url_path="/crawl" AND request_body CONTAINS "__import__" OR request_body CONTAINS "os.system" OR request_body CONTAINS "subprocess")