CVE-2026-109239Suited to automated attack · CISA
Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
CVSS score
6.9
EPSS probability
%0.3
Risk score
0.0
Published
3 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
10.0
CVE-2026-26216
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
U
Patch status unknown Public Exploits:1EPSS %6
9.2
CVE-2026-26217
Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
U
Patch status unknown Public Exploits:1EPSS %2
8.7
CVE-2026-91941
Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
U
Patch status unknownEPSS %0
8.7
CVE-2026-91940
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
U
Patch status unknownEPSS %0
8.3
CVE-2026-91943
Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
U
Patch status unknownEPSS %0
8.6
CVE-2026-109237
Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables
U
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-109239"