VulnerabilityAnalyzed

CVE-2026-56262

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations.

MEDIUM 6.9EPSS 0.76%

Does this matter?

Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.

Description

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.76% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: kidocode/crawl4ai
Source: disclosure@vulncheck.com

References

https://github.com/unclecode/crawl4aiProduct
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgThird Party Advisory
https://www.vulncheck.com/advisories/crawl4ai-unauthenticated-access-to-monitor-endpoints-via-docker-api-serverThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.