{"id":"CVE-2026-57573","aliases":["GHSA-wm69-2pc3-rmmf","PYSEC-2026-2140"],"url":"https://o3.security/vulnerability/CVE-2026-57573","summary":"Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint","details":"### Summary\n\nThe Docker API server applied its SSRF destination check (`validate_url_destination`) on the non-streaming `/crawl` path but not on the streaming path. `handle_stream_crawl_request` passed seed URLs straight to the crawler with no destination validation. A remote, unauthenticated client could call `POST /crawl/stream` (or `POST /crawl` with `crawler_config.stream=true`, which short-circuits to the same handler) with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. The Docker API is unauthenticated by default.\n\n### Affected paths\n\n`POST /crawl/stream`, and `POST /crawl` with `crawler_config.stream=true` (both route to `handle_stream_crawl_request`, `deploy/docker/api.py`).\n\n### Impact\n\nUnauthenticated read server-side request forgery: an attacker reads internal-only services and cloud-metadata endpoints (e.g. `http://169.254.169.254/` for IAM credentials), with the response body streamed back. This is the same class and severity as the project's prior \"SSRF via Direct Crawl Endpoints\" advisory; `/crawl/stream` is part of that endpoint family and was never covered by the destination check.\n\n### Fix\n\n`handle_stream_crawl_request` now validates every seed URL's destination with the same global-routability check as `handle_crawl_request`, before any fetch. The SSRF regression test was hardened to assert per-handler coverage (including the streaming handler) rather than a bare occurrence count, which previously let this gap pass.\n\n### Workarounds\n\n- Upgrade to the patched version (0.9.0).\n- Enable authentication and restrict who can reach the API (note: this does not constrain which URL the API fetches).\n- Restrict the container's outbound network access (egress firewall / no metadata route).\n\n### Credits\n\nKOH Jun Sheng - reported the streaming-path SSRF with a runnable PoC and noted the count-based regression test that masked it, plus the shared root cause with redirect/deep-crawl link following.","published":"2026-07-06T20:11:15.691Z","modified":"2026-10-28T02:30:37.408759302Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":{"score":0.00445,"percentile":0.37921,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"crawl4ai","fixedVersion":"0.9.0"}],"fix":{"url":"https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2","label":"unclecode/crawl4ai@60886d1"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57573.json"},{"type":"ADVISORY","url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57573"},{"type":"FIX","url":"https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2"},{"type":"PACKAGE","url":"https://github.com/unclecode/crawl4ai"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:37.408759302Z"}}