Crewai CVE-2026-2286

Remote unauthenticated attacker can exploit CrewAI instances with RAG (Retrieval-Augmented Generation) search tools enabled. The vulnerability requires no victim interaction. Attacker provides malicious URLs at runtime to RAG search functions, which fail to validate URL destinations, enabling access to internal services and cloud metadata endpoints.

Without CVSS scoring data, EPSS probability estimates, or KEV confirmation, direct quantification of real-world risk is limited. However, SSRF vulnerabilities in content processing tools are typically high-impact because they enable lateral movement and credential theft. CrewAI's position as an AI agent orchestration framework suggests it may run in cloud environments with access to sensitive APIs and storage; SSRF could allow attackers to exfiltrate configuration, API keys, or model weights. The attack vector appears to be network-based (runtime URL injection), and the lack of explicit authentication requirements in the description suggests unauthenticated access may be possible if the RAG tools are exposed via API. The absence of public exploit code or KEV designation does not minimize concern-SSRF is trivial to exploit once discovered, and the research community may not have published proof-of-concept code. Priority assessment should weight the deployment context: critical if CrewAI handles sensitive data or runs in multi-tenant cloud environments; moderate if isolated in controlled development settings.

An attacker provides a malicious URL to a CrewAI RAG search tool-either directly via API, embedded in a prompt, or through a supply-chain compromised data source-targeting internal services such as 'http://localhost:8080/admin' or 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'. The server processes the request without validation, fetches the content from the internal endpoint, and returns sensitive data (configuration, credentials, or cloud metadata) to the attacker. This could occur without authentication if the RAG tools are exposed as public endpoints, making exploitation trivial for any network attacker.