Threats Tagged 'cve-2026-109237'
View all threats tagged with 'cve-2026-109237'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-109237'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-109237 is a high-severity vulnerability in crawl4ai versions 0.9.0 up to but not including 0.9.4. It involves a deserialization issue where non-admin API clients can bypass configuration restrictions by wrapping forbidden config objects in dictionary-type wrappers. This allows attackers to send a specially crafted LLMConfig with an api_token referencing environment variables via the /config/dump endpoint, enabling them to read sensitive secrets such as SECRET_KEY and provider keys. With these secrets, attackers can forge admin JWT tokens. Join the discussion | CVE Database V5 | 10/12/2026, 18:31:37 UTC Added: 10/12/2026, 16:34:25 UTC |
Showing 1 to 1 of 1 result