Skip to content

CVE-2026-53754

Server-Side Request Forgery (SSRF): is CVE-2026-53754real, exploitable, or a false positive? Here's the community verdict.

☆ Watch
High · CVSS 7.5CWE-918 · Server-Side Request Forgery (SSRF)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 169.254.169.254) despite the filter by encoding an internal IPv4 address inside an IPv6 transition form, or by using the IPv6 unspecified address. Because the Docker API is unauthenticated by default (jwt_enabled: false), no credentials are required. This vulnerability is fixed in 0.8.8.

References

NVD MITRE CVE.org

Published

Embed this verdict
TruePositive verdict for CVE-2026-53754
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-53754/badge.svg)](https://www.truepositive.app/cve/CVE-2026-53754)
HTML
<a href="https://www.truepositive.app/cve/CVE-2026-53754"><img src="https://www.truepositive.app/cve/CVE-2026-53754/badge.svg" alt="TruePositive verdict for CVE-2026-53754"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts
Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

    Add a field note or remediationoptional
    Note type

    What are you adding?

    Markdown supported · minimum 20 characters.

    Related CVEs

    Same weakness: CWE-918 · Server-Side Request Forgery (SSRF).