Update Crawl4AI to 0.9.4 to Block Critical SSRF Flaw Exposing Internal Networks

The Crawl4AI web scraping library has released version 0.9.4 to address a critical security flaw that allowed attackers to access internal network resources. This server-side request forgery vulnerability, tracked as CVE-2026-109238, affects all versions of the library before the 0.9.4 patch.

According to the National Vulnerability Database, the flaw carries a CVSS score of 9.2, which is rated as critical. The vulnerability exists in the library developed by unclecode. It specifically impacts installations running version 0.7.0 through any release preceding 0.9.4. Users of these older versions are exposed to potential data leakage from their private networks.

How the Vulnerability Works

The vulnerability is classified under CWE-918, which relates to server-side request forgery. The NVD record explains that the flaw allows API clients to reach internal addresses. This occurs when the link_preview_config setting is enabled on /crawl requests within the Crawl4AI application.

An attacker can supply a controlled page to the application to trigger the exploit. By setting include_external and include_patterns parameters, the attacker influences the AsyncUrlSeeder component. This component then fetches links from internal, private, and cloud-metadata sources. The system returns the parsed head data from these restricted locations to the attacker.

Who Is Affected

Any organization or individual using Crawl4AI versions earlier than 0.9.4 is potentially affected. This includes small-business owners who may have integrated the library into their web scraping workflows. The risk is highest for those who expose the Crawl4AI API to external users or untrusted clients.

The vulnerability allows unauthorized access to cloud metadata, which often contains sensitive credentials. It also permits access to private network links that should not be visible to external API users. The NVD record confirms that the flaw enables the return of parsed head data from these internal sources.

What to watch

Users should monitor their Crawl4AI installations for the 0.9.4 update. This patch resolves the server-side request forgery issue described in CVE-2026-109238. Organizations should verify that their deployment has been upgraded to the patched version to prevent exploitation.

Security teams should review logs for unusual crawl requests. They should look for patterns where external users might be attempting to access internal resources. Identifying these attempts can help detect potential exploitation before sensitive data is compromised.

What to do and how to stay safe: Crawl4AI

• Verify your current Crawl4AI version and upgrade to 0.9.4 or later to apply the security patch.
• Disable the link_preview_config setting on /crawl requests if you cannot immediately update the library.
• Restrict API access to trusted internal networks only to prevent external attackers from triggering the flaw.
• Monitor server logs for unexpected requests to internal or cloud-metadata endpoints from external IP addresses.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109238?

The National Vulnerability Database rates the vulnerability with a CVSS score of 9.2, which is considered critical.

Which versions of Crawl4AI are vulnerable?

All versions of Crawl4AI before 0.9.4, including version 0.7.0, are affected by this server-side request forgery flaw.

How do attackers exploit this vulnerability?

Attackers enable link_preview_config on /crawl requests and set include_external and include_patterns to fetch internal links.