Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-62240

CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

CVSS 4.0 8.3 HIGHCVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-62240

Published

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-62240

Published

crewAI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "crewAIInc",
                    "product": "crewAI",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/crewai",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "1.15.1"
                        }
                    ],
                    "repo": "https://github.com/crewAIInc/crewAI"
                }

Original source record · Cite this exact observation · Complete original publisher JSON