CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NCVE-2026-56262
Medium (6.9) in kidocode crawl4ai. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in crawl4ai 0.8.7.
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kidocode:crawl4ai
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-365w-hqf6-vxfg | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| GHSA-8qrg-7j2f-rf2h | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-229 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-230 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-239 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-3443 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-3449 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-596 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |
| PYSEC-2026-798 | PyPI | crawl4ai | <0.8.7 | 0.8.7 |