CVE-2026-120630
UnknownSummary
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
Risk Assessment
An attacker can force the server to make requests to internal resources, potentially leading to data disclosure or interaction with internal services. The risk affects applications using CrewAI to fetch content from the web.
Recommendation
Update CrewAI to a patched version or implement additional URL validation (e.g., blocking private and local addresses). Consider restricting outbound requests from tools such as ScrapWebsiteTool.
Other vulnerabilities in CrewAI
See all- CVE-2026-92206High
CrewAI contains a remote code execution vulnerability via unsafe reflection during agent loading. User interaction is required—the target must load a malicious agent configuration from the repository. The flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, allowing code execution in the context of the service account.
- CVE-2026-37008High
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
- CVE-2026-62240High
CrewAI before version 1.15.1 contains a server-side request forgery (SSRF) vulnerability in the validate_url function, which performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
Original NVD description (English source)
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS