Home

Description

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

PUBLISHED Reserved 2026-07-13 | Published 2026-07-13 | Updated 2026-07-14 | Assigner VulnCheck




HIGH: 8.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

HIGH: 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Problem types

Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

Any version before 1.15.1
affected

Credits

George Chen finder

References

github.com/crewAIInc/crewAI/releases/tag/1.15.1 (crewAI 1.15.1 Release Notes) release-notes patch

github.com/crewAIInc/crewAI/issues/6520 (Researcher Disclosure) technical-description exploit issue-tracking

github.com/crewAIInc/crewAI/pull/6331 (Pull Request) issue-tracking patch

github.com/...ommit/5d4851eac797cafc45b726f65747fe2c9520fc42 (Patch Commit) patch

www.vulncheck.com/...ypass-via-http-redirect-in-scrape-tools third-party-advisory

cve.org (CVE-2026-62240)

nvd.nist.gov (CVE-2026-62240)

Download JSON