CVE-2026-56259 – Credential Exfiltration & Authentication Bypass – Crawl4AI before 0.8.8

Summary

CVE-2026-56259 is a high-severity credential exfiltration vulnerability in the Crawl4AI Docker API server, affecting all versions prior to 0.8.8. Unauthenticated remote attackers can exploit exposed LLM processing endpoints to redirect API calls to attacker-controlled infrastructure and read arbitrary server-side environment variables, enabling theft of LLM provider API keys and the JWT SECRET_KEY used to sign authentication tokens — which can in turn be leveraged for authentication bypass. The vulnerability carries a CVSS 3.1 score of 8.2 (HIGH).

Technical details

• Root cause: The Crawl4AI Docker API server exposes LLM processing endpoints (/md, /llm, /llm/job) without any authentication by default. These endpoints accept user-supplied base_url and api_token parameters that are processed without sanitization or restriction.
• Attack vector 1 – LLM provider API key exfiltration: An attacker supplies a malicious base_url parameter, redirecting outbound LLM API calls to an attacker-controlled server. The Docker API forwards the request with the server’s configured LLM provider API key attached, exposing the credential directly to the attacker.
• Attack vector 2 – Arbitrary environment variable exfiltration: The LLMConfig object supports an api_token="env:VARIABLE_NAME" syntax that resolves values at runtime via os.getenv. An attacker can set api_token to env:SECRET_KEY — or any other environment variable name — to read arbitrary server-side secrets. Exfiltrating the JWT SECRET_KEY enables forging of valid authentication tokens and a full authentication bypass.
• No authentication or user interaction required: All vulnerable endpoints are network-accessible and unauthenticated by default in the Docker deployment.
• Impact: High confidentiality impact — theft of LLM provider API keys, disclosure of arbitrary environment variables (including database credentials and other secrets), and potential full authentication bypass via a stolen JWT signing secret.

Affected software

• Crawl4AI all versions prior to 0.8.8 (i.e., all versions ≤ 0.8.7)

Severity

CVSS 3.1 base score 8.2 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Mitigation and recommended actions

• Immediate action: Upgrade Crawl4AI to version 0.8.8 or later. The patch removes attacker control over the base_url parameter (endpoint is now always derived server-side) and restricts the env: variable resolution mechanism from resolving sensitive variable names containing SECRET, PASSWORD, or PRIVATE, or matching specific prefixes such as AWS_SECRET*.
• If immediate upgrade is not possible: Restrict network-level access to the Crawl4AI Docker API server so it is not reachable from untrusted or public networks. The Docker API is internet-facing by default and should not be publicly exposed.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-56259 at NIST
• GitHub Security Advisory GHSA-f989-c77f-r2cq