Database/AI/ML frameworks & serving
Crawl4AI: request-supplied Chromium switches give command execution in the crawler container
Impact
The Docker API server accepted browser_config.extra_args from the request and passed it into Chromium's launch arguments. An attacker can inject switches that replace a child-process launch command and combine them with --no-zygote, making Chromium exec an attacker-chosen command as the container's runtime user. The API ships unauthenticated by default, so a single HTTP request is the whole exploit. On a fleet this container usually sits inside the cluster network with the crawl targets, output storage and whatever provider keys the retrieval pipeline needs, so the payoff is a foothold plus the credentials mounted next to it.
Who can reach it
Anyone who can reach the Crawl4AI Docker API port. Unauthenticated in the default deployment; an in-cluster pod or anything on the same network segment is enough, and no browser interaction is required.
What to do
Upgrade to 0.9.0 and redeploy the container. Until then, put authentication or a network policy in front of the API port and reject client-supplied browser_config.extra_args at the proxy. Container image bump and restart - no node-level maintenance.
References
Related entries
- ruflo: unauthenticated MCP bridge exposes terminal_execute, yielding a shell and provider API keysCVE-2026-59726 · ruflo MCP bridge (unauthenticated POST /mcp and /mcp/:group in the default docker-compose deployment)Critical
- Xinference: unauthenticated chat request reaches eval() in the Llama3 tool-call parserCVE-2026-61539 · Xinference (Llama3 tool-call parser, `_eval_llama3_chat_arguments`)Critical
- Decepticon: unfiltered ChatML special tokens in crawl results give a target page control of the agentCVE-2026-61732 · Decepticon (LLM message construction from crawl output)Critical
- NVIDIA NeMo Agent Toolkit: missing authentication allows unauthenticated remote code executionCVE-2026-65145 · NVIDIA NeMo Agent Toolkit (API/service authentication)Critical
- ClearML web server: XSSCVE-2024-24594 · ClearML web serverCritical
- Red Hat OpenShift AI (notebook plane): A low-privileged data-scientist account can escalate to full cluster compromiseCVE-2025-10725 · Red Hat OpenShift AI (notebook plane)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.