CVE-2026-109239 — Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress contro…
Published: 2026-10-12 · CVSS: 6.9 · CVSS 4.0
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7