Unauthenticated RCE via hooks parameter in the Crawl4AI Docker API (CVE-2026-26216)
VulnCheck added this to its KEV catalog on 2026-10-07 after its own sensors recorded exploitation attempts and a public exploit is available in XDB, so any Crawl4AI Docker API older than 0.8.0 reachable over the network should be assumed to be a target now.
The Crawl4AI Docker API's /crawl endpoint accepts a hooks parameter containing Python code that is run with exec(), and __import__ was left in the allowed builtins, so an unauthenticated POST can import os and run arbitrary system commands. Successful exploitation gives full control of the crawler host, including reading environment variables and API keys and pivoting to internal services.
Affected: Crawl4AI (pip package / Docker API deployment) < 0.8.0
How to Test
Check the installed crawl4ai package or Docker image version; anything below 0.8.0 with the Docker API running is vulnerable. On 0.8.0 and later, confirm the CRAWL4AI_HOOKS_ENABLED environment variable is not set to true unless every API user is trusted. Review the API's access logs for POST requests to /crawl whose body contains a "hooks" object, especially hook code referencing __import__, os, or subprocess; any such request from an untrusted source should be treated as an exploitation attempt and the host examined for unexpected processes, new files, and exfiltrated environment variables or API keys.
How to Patch
Upgrade to Crawl4AI v0.8.0, which removes __import__ from the allowed builtins and disables hooks by default (CRAWL4AI_HOOKS_ENABLED=false). If you cannot upgrade immediately, disable the Docker API, block the /crawl endpoint at the network level, or put authentication in front of the API.