CVE-2026-56262CWE-306

Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server

Medium · published June 24, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00756 · 54.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-24T11:53Z
EPSS history
Timeline
  • 24 JUN 11:53Z
    Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
    cvelistv5