High 2026-07-13

Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)

A flaw in the Crawl4AI Docker API lets an attacker redirect where results get sent and simultaneously trick the server into resolving an environment variable on its own machine, treating it as if it were a credential the caller supplied. The server then forwards that secret to the attacker's chosen endpoint.

How the attack works

The attacker calls the Crawl4AI API and sets a base_url or endpoint parameter to a server they control. In the same request, they set a credential field like api_token, api_key, or secret to the literal string "env:SOME_VARIABLE_NAME" instead of a real key. The vulnerable server interprets that string as an instruction, looks up the named environment variable on its own host, and sends the resolved value to the attacker-controlled endpoint. This can leak provider API keys, JWT signing secrets, or any other environment variable the server process has access to — none of which the caller was ever authorized to see.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 9dd01834-41c5-476c-9628-6a0c20663b7c
Severity: High
CVEs: CVE-2026-56259

Classification

AML.T0024 · Exfiltration via AI Inference API ASI03 · Identity and Impersonation ASI04 · Memory and Context Poisoning LLM02 · Sensitive Information Disclosure LLM06 · Excessive Agency

Why it matters

An external caller can extract server-side secrets (API keys, signing secrets, other credentials) they should never have access to, by abusing a single API call with no prior access to the environment. This can lead to further compromise of connected AI providers or services using the stolen keys.

What you can do

→Never let user-supplied field values be resolved as server-side environment variable lookups; treat all incoming credential fields as opaque literal values.
→Restrict or validate base_url / endpoint-redirect parameters to an allowlist of known destinations.
→Audit environment variables available to the Crawl4AI service and remove any secrets it does not strictly need.
→Review logs for requests containing the literal pattern "env:" in credential fields combined with unfamiliar base_url values.

Known benign look-alikes

Documentation or .env.example files showing 'API_KEY=your-key-here' style placeholders — no literal env: resolution-trick syntax.
Legitimate code using os.environ.get('VAR_NAME') or process.env.VAR_NAME — different syntax from the literal 'env:VAR_NAME' string-value trick this rule targets.
A base_url field pointing to a well-known first-party provider domain with no accompanying env: token trick.