CVE-2026-62240

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42	Patch
https://github.com/crewAIInc/crewAI/issues/6520	Exploit Issue Tracking Patch
https://github.com/crewAIInc/crewAI/pull/6331	Exploit Issue Tracking Vendor Advisory
https://github.com/crewAIInc/crewAI/releases/tag/1.15.1	Release Notes
https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) CrewAI anterior a 1.15.1 contiene una vulnerabilidad de falsificación de petición del lado del servidor en la función validate_url que realiza una resolución DNS única y comprobaciones de lista de bloqueo antes de devolver la URL original sin cambios. Los atacantes pueden eludir el filtro de seguridad al proporcionar URLs que redirigen a direcciones internas o utilizar técnicas de reenlace DNS para acceder a servicios internos y puntos finales de metadatos en la nube.

17 Sep 2026, 18:16

Type	Values Removed	Values Added
References	~~() https://github.com/crewAIInc/crewAI/issues/6520 - Issue Tracking, Exploit, Patch~~	() https://github.com/crewAIInc/crewAI/issues/6520 - Exploit, Issue Tracking, Patch

Information

Published : 2026-07-13 22:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-62240

Mitre link : CVE-2026-62240

CVE.ORG link : CVE-2026-62240

JSON object : View

Products Affected

crewai

crewai

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-62240", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62240", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T13:06:00.658738Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/crewAIInc/crewAI", "vendor": "crewAIInc", "product": "crewAI", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.1", "versionType": "semver"}], "packageURL": "pkg:pypi/crewai", "defaultStatus": "unaffected"}]}], "published": "2026-07-13T22:16:52.117", "references": [{"url": "https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crewAIInc/crewAI/issues/6520", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crewAIInc/crewAI/pull/6331", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crewAIInc/crewAI/releases/tag/1.15.1", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools", "tags": ["Third Party Advisory", "VDB Entry"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints."}, {"lang": "es", "value": "CrewAI anterior a 1.15.1 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en la funci\u00f3n validate_url que realiza una resoluci\u00f3n DNS \u00fanica y comprobaciones de lista de bloqueo antes de devolver la URL original sin cambios. Los atacantes pueden eludir el filtro de seguridad al proporcionar URLs que redirigen a direcciones internas o utilizar t\u00e9cnicas de reenlace DNS para acceder a servicios internos y puntos finales de metadatos en la nube."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21FB3EF2-DABA-4E6D-B02A-76F9A71D61A0", "versionEndExcluding": "1.15.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}