Summary
CVE-2026-53755 is a Server-Side Request Forgery (SSRF) vulnerability in Crawl4AI’s Docker API server, affecting all versions prior to 0.8.9. The flaw arises because the server’s SSRF protection validates only the crawl target URL and not the proxy destination, allowing an unauthenticated remote attacker to route Chromium’s network traffic through a proxy pointed at internal services or cloud metadata endpoints. With a CVSS v3.1 base score of 8.6 (High) and a Changed scope (S:C), successful exploitation can expose sensitive internal infrastructure and cloud credentials without any authentication or user interaction.
Technical details
- Root cause: The Docker API server’s SSRF destination check was applied exclusively to the crawl target URL, leaving all proxy-related configuration fields entirely unvalidated (CWE-918).
- Trigger conditions: Any unauthenticated HTTP request to the
/crawl,/crawl/stream, or/crawl/jobendpoints — the Docker API requires no authentication by default. - Attack vector: An attacker submits a request containing a legitimate, publicly-routable crawl URL (to pass the SSRF check) while supplying an internal IP or cloud metadata address as the proxy server. Chromium routes its egress traffic through the attacker-specified proxy, and the responses are returned to the attacker.
- Vulnerable fields:
browser_config.proxy_config.server,browser_config.proxy(deprecated field),crawler_config.proxy_config.server, and Chromium command-line flags--proxy-server,--proxy-pac-url,--proxy-bypass-list, and--host-resolver-rulespassed viabrowser_config.extra_args. - Impact: Unauthenticated access to internal network services and cloud instance metadata endpoints (e.g., AWS IMDSv1 at
169.254.169.254), with potential leakage of IAM credentials and sensitive internal data. The Changed scope (S:C) reflects the ability to impact resources beyond the vulnerable component itself.
Affected software
- Crawl4AI (
crawl4aion PyPI) — all versions prior to 0.8.9
Severity
CVSS v3.1 base score: 8.6 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Upgrade to Crawl4AI 0.8.9 or later. The fix extends the existing global-routability validation to proxy destinations and strips proxy-related flags from
extra_args, preventing internal address routing. - If immediate patching is not possible:
- Enable API authentication by setting the
CRAWL4AI_API_TOKENenvironment variable to restrict unauthenticated access to the Docker API server. - Apply egress firewall rules on the container’s network to block outbound access to internal IP ranges and cloud metadata endpoints (e.g.,
169.254.169.254, RFC 1918 ranges).
- Enable API authentication by setting the
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

