Crawl4AI prior to version 0.8.8 contains vulnerabilities in its Docker API server that allow unauthenticated attackers to redirect large language model (LLM) API calls to attacker-controlled endpoints. By supplying a malicious base_url parameter and setting the api_token parameter to env:VARIABLE_NAME, attackers can read arbitrary environment variables. This includes sensitive secrets like provider API keys and JWT SECRET_KEY, which can be used to bypass authentication mechanisms. The affected endpoints are /md, /llm, and /llm/job, all of which do not require authentication, facilitating exploitation.

Successful exploitation allows attackers to exfiltrate sensitive environment variables, including API keys and authentication secrets such as JWT SECRET_KEY. This can lead to unauthorized access, authentication bypass, and potential compromise of the server and connected services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and avoid exposing the Docker API server publicly. Monitor for unusual API call redirections and environment variable access patterns.