CrewAI CVE-2026-62240

Exploitation requires a CrewAI deployment (before 1.15.1) that feeds an attacker-supplied or attacker-influenceable URL into one of the scrape/web-fetch tools that call validate_url - this is the UI:P/passive-interaction prerequisite in the CVSS 4.0 vector: an agent workflow must be induced to fetch the malicious URL. The attacker must control a web server that either serves an HTTP redirect to an internal address or performs DNS rebinding (answering the validation lookup with a public IP and the fetch with a private one). No authentication is needed (PR:N). Realistic limiting factors: the target must expose CrewAI scraping to untrusted URL input, and impact hinges on reachable internal services or a live cloud metadata endpoint (e.g., IMDSv1); hardened egress filtering or IMDSv2 materially reduces the payoff.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H, SC:H) scores 8.3 (High): network-reachable, low complexity, no privileges, but with passive user interaction and a scope change reflected by high subsequent-system confidentiality impact - consistent with SSRF reaching internal/metadata systems. Publicly available exploit code and a VulnCheck advisory raise practical risk, and DNS rebinding plus redirect-following makes the bypass reliable rather than theoretical. Impact is confidentiality-only (VI/VA:N) - this reads internal data (e.g., cloud credentials from metadata) rather than modifying or destroying it. The main limiter is that a CrewAI deployment must actually feed an attacker-influenced URL into a scrape tool (the UI:P/user-interaction factor), so real-world exposure depends on how the framework is integrated. No EPSS score and no CISA KEV entry were provided, so widespread automated exploitation is unconfirmed; treat this as a credible, POC-backed priority for CrewAI operators rather than a mass-exploited campaign.

An attacker submits a URL under their control to an application that hands it to a CrewAI agent's scrape tool; the URL passes validate_url's one-shot check by resolving to a public IP, then returns an HTTP 302 redirect (or rebinds via DNS) to http://169.254.169.254/latest/meta-data/. CrewAI follows it and returns the cloud instance's IAM credentials or internal service responses to the attacker. Publicly available POC/exploit material demonstrates the redirect-based bypass (VulnCheck advisory and issue #6520).