CVE-2026-62240
CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
| CWE | CWE-918 |
| Vendor | crewaiinc |
| Product | crewai |
| Published | Jul 13, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for crewaiinc crewai
Be the first to know when new high vulnerabilities affecting crewaiinc crewai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
crewAIInc / crewAI
0 < 1.15.1
References
github.com: https://github.com/crewAIInc/crewAI/releases/tag/1.15.1 github.com: https://github.com/crewAIInc/crewAI/issues/6520 github.com: https://github.com/crewAIInc/crewAI/pull/6331 github.com: https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42 vulncheck.com: https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools
Credits
George Chen