PT-2026-29050 · Crewai · Crewai

Yarden Porat · Published 2026-03-30 · Updated 2026-04-02 · CVE-2026-2286

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CrewAI (affected versions not specified)

Description CrewAI contains a server-side request forgery condition that allows for the acquisition of content from internal and cloud services. This is facilitated by Retrieval-Augmented Generation (RAG) search tools that do not properly validate URLs provided during runtime. The issue allows an attacker to potentially access resources that should not be publicly accessible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2286

Affected Products

Crewai

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2286 · Security Note
• https://kb.cert.org/vuls/id/221883 · Reddit Post
• https://twitter.com/infoflowcloud/status/2039006596890501302 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1s8rqzh/crewai_vulnerabilities_open_door_to_hacking · Reddit Post
• https://twitter.com/CVEnew/status/2039004524124209531 · Twitter Post
• https://twitter.com/PwrtYrdn/status/2039327529316540425 · Twitter Post