CVE-2026-120630

UNKNOWN 0.0

CVE-2026-120630

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

Vendor	crewai
Product	crewai
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for crewai crewai

Be the first to know when new unknown vulnerabilities affecting crewai crewai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

CrewAI / CrewAI

0 < 1.15.17

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.crewai.com: https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool badcast.dev: https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/ github.com: https://github.com/crewAIInc/crewAI/pull/6981