CVE-2026-62240CWE-918ssrf

CVE-2026-62240

High · published July 14, 2026

CVSS v3.1
7.4
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-14T02:16Z
Affected products (1)
ProductVersionsFixed in
crewai/crewai< 1.15.11.15.1
References (5)
https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42 · [email protected]https://github.com/crewAIInc/crewAI/issues/6520 · [email protected]https://github.com/crewAIInc/crewAI/pull/6331 · [email protected]https://github.com/crewAIInc/crewAI/releases/tag/1.15.1 · [email protected]https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools · [email protected]
EPSS history
Timeline
  • 13 JUL 21:04Z
    CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
    cvelistv5