Critical severity9.8NVD Advisory· Published Mar 30, 2026· Updated Apr 15, 2026
CVE-2026-2286
CVE-2026-2286
Description
CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.kb.cert.org/vuls/id/221883nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.