The vulnerability exists because the Docker API server in crawl4ai applied SSRF destination checks only on the non-streaming /crawl path but not on the streaming path. The function handle_stream_crawl_request directly passes seed URLs to the crawler without validating if the destination is internal, private, or link-local. Consequently, a remote unauthenticated client can send POST requests to /crawl/stream or /crawl with crawler_config.stream=true with URLs pointing to internal network resources. The server fetches these URLs and streams the response back to the attacker. This SSRF flaw allows attackers to access internal network resources, potentially exposing sensitive data. The vulnerability is resolved in crawl4ai version 0.9.0.

An unauthenticated remote attacker can exploit this SSRF vulnerability to cause the server to make HTTP requests to internal or private network addresses. This can lead to unauthorized access to internal services or sensitive information disclosure. The CVSS score of 8.6 (high) reflects the high confidentiality impact with no integrity or availability impact. There are no known exploits in the wild as of the published date.

Upgrade crawl4ai to version 0.9.0 or later, where the SSRF vulnerability is fixed by applying destination validation on the streaming crawl path. No other mitigation is indicated or required by the vendor advisory. Patch status is not explicitly stated as 'official-fix' but the fix is included in version 0.9.0.