PT-2026-29050 · Crewai · Crewai

Yarden Porat · Publicado 2026-03-30 · Atualizado 2026-04-02 · CVE-2026-2286

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CrewAI (affected versions not specified)

Description CrewAI contains a server-side request forgery condition that allows for the acquisition of content from internal and cloud services. This is facilitated by Retrieval-Augmented Generation (RAG) search tools that do not properly validate URLs provided during runtime. The issue allows an attacker to potentially access resources that should not be publicly accessible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-2286

Produtos afetados

Crewai

Referências · 6

• https://kb.cert.org/vuls/id/221883 · Publicação no Reddit
• https://twitter.com/infoflowcloud/status/2039006596890501302 · Publicação no Twitter
• https://reddit.com/r/pwnhub/comments/1s8rqzh/crewai_vulnerabilities_open_door_to_hacking · Publicação no Reddit
• https://twitter.com/CVEnew/status/2039004524124209531 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2286 · Nota de Segurança
• https://twitter.com/PwrtYrdn/status/2039327529316540425 · Publicação no Twitter