PT-2026-57904 · Crewaiinc · Crewai

George Chen · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-62240

NVD

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-62240

Affected Products

Crewai

References · 6

• 🔥 https://github.com/crewAIInc/crewAI/issues/6520 · Exploit
• https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-62240 · Security Note
• https://github.com/crewAIInc/crewAI/releases/tag/1.15.1 · Note
• https://github.com/crewAIInc/crewAI/pull/6331 · Note
• https://vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools · Note