Medium severity · published Jun 24, 2026
CVE-2026-56262
Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crawl4AI · Crawl4AI
before 0.8.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56262
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56262
Product
https://github.com/unclecode/crawl4ai
Third Party Advisory
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
Third Party Advisory
https://www.vulncheck.com/advisories/crawl4ai-unauthenticated-access-to-monitor-endpoints-via-docker-api-server
More from Crawl4AI
9.8
CVE-2026-56265
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
9.1
CVE-2026-56260
Crawl4AI - Arbitrary File Write via output_path Parameter
8.6
CVE-2026-56266
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
8.2
CVE-2026-56259
Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution
8.1
CVE-2026-56258
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU