CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109237
HIGHCVSS 8.1NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KE
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-109238 HIGH 8.6
- CVE-2026-109239 MEDIUM 5.3
- CVE-2026-105274
- CVE-2026-96618
- CVE-2026-109397 HIGH 7.2
- CVE-2026-109398 HIGH 7.5
- CVE-2026-109399 HIGH 8.1
- CVE-2026-107248
- CVE-2026-108900 HIGH 7.3
- CVE-2026-92877