Does CVE-2026-109238 Expose Internal Networks in Crawl4AI Before 0.9.4?

The short version

• The vulnerability is classified as Server-Side Request Forgery (CWE-918).
• It enables unauthorised access to private network data via the API.
• Versions before 0.9.4 are confirmed to be affected by this issue.

The details

The National Vulnerability Database records CVE-2026-109238 as a critical flaw within the Crawl4AI library. This server-side request forgery issue affects all versions prior to 0.9.4, as maintained by unclecode. The vulnerability carries a CVSS score of 9.2, indicating severe risk to systems that expose the library to external input.

According to the NVD description, the flaw arises when API clients enable the `link_preview_config` option on `/crawl` requests. Attackers can supply a controlled page with specific settings, including `include_external` and `include_patterns`. This configuration causes the AsyncUrlSeeder component to fetch links from internal, private, and cloud-metadata sources. The system then returns the parsed head data of these private resources to the attacker, bypassing standard network boundaries.

The context

This vulnerability highlights the risks associated with web scraping libraries that process external URLs. By allowing configuration options that trigger internal fetches, the library inadvertently provides a pathway for attackers to probe internal infrastructure. The exposure of cloud-metadata links is particularly concerning for organisations hosting services in public cloud environments, where such data often contains sensitive credentials or configuration details.

Next steps

Security teams should immediately audit their use of Crawl4AI to identify instances where the library is exposed to untrusted API users. Any instance running a version before 0.9.4 should be considered vulnerable. Organisations must determine if they can isolate these services from external networks or disable the specific configuration options that trigger the flaw until a secure version is available.

What to do and how to stay safe: Crawl4AI

• Restrict access to the /crawl endpoint to trusted internal services only.
• Monitor network logs for unexpected outbound connections from scraping services.
• Disable link_preview_config in all Crawl4AI configurations exposed to external input.
• Review cloud metadata endpoints to ensure they are not accessible from the scraping environment.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109238?

The CVSS score is 9.2, which is rated as Critical by the NVD.

Which versions of Crawl4AI are affected?

All versions before 0.9.4 are affected by this vulnerability.

How is the vulnerability exploited?

Attackers enable link_preview_config on /crawl requests and supply controlled pages to fetch internal links.