High severity7.4NVD Advisory· Published Jul 13, 2026· Updated Sep 17, 2026
CVE-2026-62240
CVE-2026-62240
Description
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
crewai-toolsPyPI | < 1.15.1 | 1.15.1 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42nvdPatchWEB
- github.com/crewAIInc/crewAI/issues/6520nvdExploitIssue TrackingPatchWEB
- github.com/crewAIInc/crewAI/pull/6331nvdExploitIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-mr4r-hcgx-8p4hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-62240ghsaADVISORY
- www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-toolsnvdThird Party AdvisoryVDB EntryWEB
- github.com/crewAIInc/crewAI/releases/tag/1.15.1nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.