CVE-2026-109237: Deserialization of Untrusted Data in unclecode crawl4ai

CVE-2026-109237 affects crawl4ai versions >=0.9.0 and <0.9.4. The vulnerability arises from an untrusted-config gate bypass that permits non-admin API clients to construct forbidden configuration objects by wrapping them in dict-type wrappers. Attackers exploit this by sending a laundered LLMConfig containing an api_token set to an environment variable reference through the /config/dump API endpoint. This enables unauthorized reading of sensitive secrets including SECRET_KEY and provider keys, which can then be used to forge admin JWT tokens, effectively escalating privileges.

Successful exploitation allows an attacker with non-admin API access to read sensitive environment secrets such as SECRET_KEY and provider keys. This leads to privilege escalation by enabling the attacker to forge admin JWT tokens, potentially granting full administrative control over the application.

The vulnerability affects crawl4ai versions from 0.9.0 up to but not including 0.9.4. Users should upgrade to version 0.9.4 or later where this issue is fixed. Patch status is confirmed by the affected version range. Until upgrading, restrict API access to trusted clients and monitor for suspicious activity related to the /config/dump endpoint.