CVE-2026-57573

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.0

Description The Docker API server fails to apply Server-Side Request Forgery (SSRF) destination checks on the streaming path. A remote unauthenticated client can exploit this by calling the 'POST /crawl/stream' endpoint or the 'POST /crawl' endpoint with the crawler config.stream variable set to true. The handle stream crawl request() function passes seed URLs directly to the crawler without validation, allowing the server to fetch and stream response bodies from internal, private, or link-local addresses.

Recommendations Update to version 0.9.0.