CVE-2026-92206
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
CrewAI contains a remote code execution vulnerability via unsafe reflection during agent loading. User interaction is required—the target must load a malicious agent configuration from the repository. The flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, allowing code execution in the context of the service account.
Risk Assessment
An attacker can trick a user into loading a malicious agent configuration, leading to arbitrary code execution in the context of the CrewAI service account. This can result in system and data compromise.
Recommendation
Update CrewAI to a patched version or avoid loading agents from untrusted repositories. Verify agent configurations before loading.
Other vulnerabilities in CrewAI
See all- CVE-2026-120630Unknown
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
- CVE-2026-37008High
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
- CVE-2026-62240High
CrewAI before version 1.15.1 contains a server-side request forgery (SSRF) vulnerability in the validate_url function, which performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
Original NVD description (English source)
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS