GPU VulnDB

Database/AI/ML frameworks & serving

Crawl4AI: /crawl hooks parameter runs attacker Python through exec(), giving unauthenticated RCE

CVSS 10.0CVE-2026-26216AI/ML frameworks & servingcurated

Impact

The Docker API deployment accepts a hooks parameter containing Python source and passes it to exec() with __import__ left in the allowed builtins, so the allowlist is decorative: an unauthenticated caller imports os and runs commands as the container process. The advisory describes full server compromise - command execution, arbitrary file read and write, data exfiltration and lateral movement into internal networks. Crawl4AI is typically deployed as a shared scraping/ingestion service feeding a RAG or agent pipeline, so it usually sits inside the fleet network and holds the API keys of whatever it feeds, which makes it a convenient pivot rather than an isolated workload.

Who can reach it

Any unauthenticated client that can reach the Crawl4AI Docker API HTTP endpoint - no credentials, no prior access.

What to do

Upgrade to Crawl4AI 0.8.0 or later and redeploy the container; that is an image pull and a daemon restart per instance, no node drain. If an upgrade cannot happen immediately, take the API off any network a tenant or untrusted service can reach and rotate the credentials the container holds, since exploitation is trivial and the advisory is public.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-26216https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxphttps://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameterhttps://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.