CrewAI
CVE-2026-62240
HIGH
GHSA-mr4r-hcgx-8p4h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity redirect bypass with no auth (PR:N) but requires a workflow to fetch the URL (UI:R); reaching internal/metadata systems is a scope change (S:C) with confidentiality-only impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
AnalysisAI
Server-side request forgery in CrewAI's scraping tools before version 1.15.1 lets remote attackers reach internal services and cloud metadata endpoints by abusing a flawed validate_url function. The filter performs a single DNS resolution and blocklist check, then returns the original URL unchanged, so attacker-supplied URLs that HTTP-redirect to internal addresses or exploit DNS rebinding slip past the guard. Publicly available exploit code exists (VulnCheck advisory and issue #6520), but there is no public exploit identified as being used in active attacks.
Technical ContextAI
CrewAI is an open-source Python framework for orchestrating multi-agent AI workflows, whose agents can fetch and scrape web content via built-in scrape tools. The root cause is CWE-918 (SSRF): the validate_url function implements a time-of-check/time-of-use gap - it resolves the hostname once and checks it against an internal-address blocklist, but then hands back the raw user-supplied URL for the actual fetch. Because validation and use are decoupled, a server the attacker controls can answer the initial DNS/validation lookup with a benign public IP and then either issue an HTTP redirect to an internal target or re-resolve (DNS rebinding) to a private address such as 169.254.169.254 for cloud metadata. The affected component is identified by CPE cpe:2.3:a:crewaiinc:crewai:*:*:*:*:*:*:*:* and the fix landed in PR #6331 / commit 5d4851eac797cafc45b726f65747fe2c9520fc42.
RemediationAI
Vendor-released patch: upgrade to CrewAI 1.15.1 or later, which fixes the SSRF redirect bypass in scraping fetches (release notes list 'Fix SSRF redirect bypass in scraping fetches (#6331)'; fix commit 5d4851eac797cafc45b726f65747fe2c9520fc42). If you cannot upgrade immediately, avoid passing untrusted or externally-influenced URLs into CrewAI scrape tools, and place egress controls so the host running CrewAI cannot reach internal ranges - block or deny outbound access to RFC1918 addresses and to the cloud metadata endpoint 169.254.169.254 (on AWS, enforce IMDSv2 to blunt metadata theft); the trade-off is that legitimate internal scraping targets will also be blocked. Additionally disable HTTP redirect following for scrape requests and validate the final resolved IP at fetch time rather than only at check time. See the vendor release (https://github.com/crewAIInc/crewAI/releases/tag/1.15.1) and VulnCheck advisory (https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools).
Sandbox escape in CrewAI's CodeInterpreterTool allows untrusted Python code to break out of the in-process restricted ex
CrewAI fails to validate Docker runtime availability during execution and silently reverts to an insecure sandbox mode,
Server-side request forgery in CrewAI's RAG search tools allows remote attackers to access internal and cloud services b
CrewAI's JSON loader tool fails to validate file paths before reading, allowing arbitrary local file access that exposes
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today