Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
HIGH severity

Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolutionGHSA-f989-c77f-r2cq

HIGH

GHSA-f989-c77f-r2cq is a high-severity (CVSS 8.2) Information Exposure vulnerability in crawl4ai. A fix is available for crawl4ai — see the affected versions and patch details below.

Also known asCVE-2026-56259PYSEC-2026-3448
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-f989-c77f-r2cq.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs38th percentile — riskier than 38% of all scored CVEsHighest risk
0.00%0.31%0.62%0.93%0.3%0.4%0.4%0.4%Aug 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-f989-c77f-r2cq by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 397,508 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐍crawl4ai

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused to exfiltrate server-held secrets. The Docker API is unauthenticated by default.

Vector 1 - attacker base_url

/md, /llm, and /llm/job accepted a base_url in the request and used it as the LLM endpoint while still attaching the server's configured provider API key. An attacker set base_url to a server they control and received the provider key (and any provider keys the server holds) in the inbound request.

Vector 2 - arbitrary environment variable read via env:

LLMConfig(api_token="env:NAME") resolved NAME from the server environment with os.getenv. Because request bodies were deserialized into LLMConfig (via a crawler config / extraction strategy), an attacker could set api_token="env:SECRET_KEY" (or env:REDIS_PASSWORD, etc.) and, paired with an attacker base_url, exfiltrate that secret. Reading the server's SECRET_KEY enables forging authentication tokens.

Impact

Disclosure of LLM provider API keys and other server secrets to an attacker-controlled endpoint; reading the JWT SECRET_KEY can lead to authentication bypass.

Fix

  • The LLM endpoints ignore a request-supplied base_url; the endpoint is always derived server-side from the provider name. The field is still accepted but no longer honored (no breaking 4xx).
  • LLMConfig refuses env: resolution of protected environment-variable names (names containing SECRET/PASSWORD/PRIVATE, prefixes CRAWL4AI*/AWS_SECRET*, and SECRET_KEY/REDIS_PASSWORD/TOKEN). Normal provider keys (e.g. OPENAI_API_KEY) are unaffected.

Workarounds

  • Upgrade to the patched version.
  • Enable authentication (CRAWL4AI_API_TOKEN).
  • Do not place sensitive secrets in the server environment alongside provider keys.

Credits

  • Geo (geo-chen) - reported the LLM credential exfiltration via request base_url.
  • Internal security audit (Crawl4AI maintainers) - the env: arbitrary-variable read.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIcrawl4aiall versions0.8.8pip install --upgrade 'crawl4ai==0.8.8'

Affected Products

1 product · 1 configurations
Application
crawl4aikidocode
< 0.8.8
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for crawl4ai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update crawl4ai to 0.8.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f989-c77f-r2cq is resolved across your whole dependency graph.

  3. Workarounds

    Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Frequently Asked Questions

### Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused to exfiltrate server-held secrets. The Docker API is unauthenticated by default. ### Vector 1 - attacker base_url `/md`, `/llm`, and `/llm/job` accepted a `base_url` in the request and used it as the LLM endpoint while still attaching the server's configured provider API key. An attacker set `base_url` to a server they control and received the provider key (and any provider keys the server holds) in the inbound request. ### Vector
O3 Security · Impact-Aware SCA

Is GHSA-f989-c77f-r2cq in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Crawl4AI: LLM credential exfiltration in Docker server via…