title: Environment-Variable-Resolution Credential Exfiltration via Redirected Endpoint (CVE-2026-56259)
id: ATR-2026-02262
rule_version: 1
status: experimental
description: |
  Detects the Crawl4AI Docker API credential-exfiltration pattern (CVE-2026-56259): an attacker supplies a malicious base_url/endpoint-redirect parameter alongside a credential-like field (api_token, api_key, secret) whose VALUE is the literal string "env:VARIABLE_NAME" — a resolution-trick syntax that tells the vulnerable server to look up an environment variable server-side and forward it (as the resolved credential) to the attacker-redirected endpoint. This leaks provider API keys, JWT secrets, and other server-side environment variables that the caller never legitimately had access to. Distinct from ordinary env-var documentation (`.env` file examples, `os.environ.get(...)` code) because the literal "env:NAME" string is itself the exploit payload, not a code snippet describing how env vars work.
author: ATR Community (NVD sync + CVE-2026-56259)
date: 2026/07/13
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
    - ASI04:2026
  mitre_atlas:
    - AML.T0024 - Exfiltration via ML Inference API
  mitre_attack:
    - 'T1552.001 - Unsecured Credentials: Credentials In Files'
    - T1041 - Exfiltration Over C2 Channel
  cve:
    - CVE-2026-56259
  research:
    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f989-c77f-r2cq
    - https://www.vulncheck.com/advisories/crawl4ai-llm-credential-exfiltration-via-base-url-and-environment-variable-resolution
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (third-party components monitored as part of maintenance) is supported where this rule detects the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the context-exfiltration technique (env-resolution credential exfiltration via redirected endpoint) as a treatment control.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: env-resolution-credential-exfil
  scan_target: both
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - 'Documentation or .env.example files showing ''API_KEY=your-key-here'' style placeholders — no literal env: resolution-trick syntax.'
    - Legitimate code using os.environ.get('VAR_NAME') or process.env.VAR_NAME — different syntax from the literal 'env:VAR_NAME' string-value trick this rule targets.
    - 'A base_url field pointing to a well-known first-party provider domain with no accompanying env: token trick.'
  conditions:
    - field: content
      operator: regex
      value: (?i)"?(?:api[_-]?token|api[_-]?key|secret|auth[_-]?token)"?\s*[:=]\s*"?env:[A-Z_][A-Z0-9_]{2,}"?[\s\S]{0,300}"?base[_-]?url"?\s*[:=]\s*"?https?://(?!api\.(?:openai|anthropic|openrouter)\.com)(?![^\s"]*\.(?:internal|local|lan)\b)(?!(?:[\w.-]*\.)?(?:internal|private|corp|intranet)[.\-])(?!localhost|127\.0\.0\.1|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.)
      description: Credential-like field set to the literal env:VARNAME resolution trick, co-located with a base_url pointing off the well-known first-party provider domains AND not an internal/private-looking host (.internal/.local/.lan/'internal'/'corp' in the hostname, RFC1918 ranges, localhost) — those are a company's own self-hosted gateway, not an attacker redirect. This is the Crawl4AI exfil primitive.
    - field: content
      operator: regex
      value: (?i)"?base[_-]?url"?\s*[:=]\s*"?https?://(?!api\.(?:openai|anthropic|openrouter)\.com)(?![^\s"]*\.(?:internal|local|lan)\b)(?!(?:[\w.-]*\.)?(?:internal|private|corp|intranet)[.\-])(?!localhost|127\.0\.0\.1|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.)[^\s"]{1,200}[\s\S]{0,300}"?(?:api[_-]?token|api[_-]?key|secret|auth[_-]?token)"?\s*[:=]\s*"?env:[A-Z_][A-Z0-9_]{2,}"?
      description: 'Same primitive expressed base_url-first (reverse order) — a redirect target (excluding internal/private-looking hosts) followed by an env: resolution-trick credential field'
    - field: content
      operator: regex
      value: (?i)(?:redirect|exfiltrat\w*)[^\n]{0,60}(?:llm|provider)[^\n]{0,40}(?:api\s*call|request)[^\n]{0,60}env:[A-Z_][A-Z0-9_]{2,}
      description: Skill/document content explicitly describing redirecting LLM provider API calls to leak an env-resolved credential
response:
  actions:
    - block_tool
    - alert
    - require_human_review
  message_template: |
    [ATR-2026-02262] HIGH: Environment-variable-resolution credential exfiltration pattern detected (CVE-2026-56259 class). A credential-like field resolves via the literal "env:VARNAME" trick and is co-located with a redirected base_url — block the request, rotate any server-side secrets the target env var names, and audit for unauthenticated access to LLM-gateway config endpoints.
confidence: 78