Crawl4AI: CacheValidator freshness check bypasses the egress proxy, giving blind SSRF from the crawler container

Impact

Crawl4AI's Docker server is deployed as a crawling backend for LLM and agent pipelines, and its egress proxy is the control that keeps that crawling pointed outward. An API client that enables check_cache_freshness can cache a URL it controls and then have CacheValidator fetch it outside the proxy, following 302 redirects or DNS rebinding to internal and cloud-metadata addresses. The result is blind port and service discovery from inside the cluster - no response body returned to the attacker, so this is reconnaissance against internal endpoints rather than data theft. Where the crawler runs on a fleet node with an instance metadata endpoint reachable, the internal surface it can probe includes that endpoint.

Who can reach it

Any client able to call the Crawl4AI Docker server's API; the scored vector requires no privileges, so an instance reachable without authentication is exposed to anyone who can reach it.

What to do

Upgrade Crawl4AI to 0.9.5 or later and restart the container - a container redeploy, no host maintenance. Until then, disable or reject check_cache_freshness at your own API gateway, and enforce egress restrictions at the network layer rather than inside the application so a bypassed in-process proxy cannot reach RFC1918 or link-local metadata addresses.

References

Related entries

• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium