Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-115411crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

Medium 5.0

In plain English

A medium-severity server-side request forgery in crawlseo from crawlseo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.

Affected products (as reported)

Vendor	Product	Versions
crawlseo	crawlseo	0.1.0 – before 0.2.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/crawlseo/crawlseo/commit/76e4e693de0c6b294cf1f60656800e47346f1c28 issue-tracking, patch
Vendor Patch patch
https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399 technical-description
VulnCheck Advisory: crawlseo before 0.2.4 Server-Side Request Forgery via Crawler third-party-advisory