CVE-2026-62240: Crewai Crewai SSRF Vulnerability

CVE-2026-62240 Overview

CVE-2026-62240 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting CrewAI versions prior to 1.15.1. The flaw resides in the validate_url function, which performs a one-shot Domain Name System (DNS) resolution and blocklist check before returning the original URL unchanged. Because the URL is re-fetched later without re-validation, attackers can bypass the filter by supplying URLs that redirect to internal addresses or by leveraging DNS rebinding techniques. Exploitation allows attackers to reach internal services and cloud metadata endpoints from the CrewAI host.

Critical Impact
Attackers can bypass CrewAI's SSRF protections to access internal network services and cloud metadata endpoints, exposing credentials and sensitive infrastructure data.

Affected Products

CrewAI versions prior to 1.15.1
CrewAI Tools scraping loaders (docs_site_loader.py, docx_loader.py)
Any application embedding vulnerable CrewAI RAG loader components

Discovery Timeline

2026-07-13 - CVE CVE-2026-62240 published to National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-62240

Vulnerability Analysis

The vulnerability affects CrewAI's URL scraping tools used by RAG (Retrieval-Augmented Generation) loaders. The validate_url function resolves the supplied hostname once, checks the resolved IP against a blocklist of internal ranges, and then returns the caller's original URL string unchanged. The subsequent HTTP client re-resolves the hostname and follows redirects independently of the validation step. This creates a Time-of-Check to Time-of-Use (TOCTOU) gap that attackers exploit to reach restricted destinations.

Attackers can host a public URL that returns an HTTP 3xx response pointing to http://169.254.169.254/ or http://127.0.0.1/. Alternatively, they can serve a hostname that resolves to a public IP on first lookup and an internal IP on second lookup — the DNS rebinding pattern. The scraping tools then fetch the internal resource and return its content to the attacker through the agent workflow.

Root Cause

The root cause is incomplete SSRF filtering in validate_url. The function validates the input URL only, does not disable redirect following, and does not pin the resolved IP for the subsequent fetch. Redirect targets and re-resolved hostnames therefore bypass the blocklist.

Attack Vector

Exploitation requires an attacker to submit a malicious URL to a CrewAI agent that invokes an affected scraping loader. User interaction is required to trigger the fetch, but no authentication is needed on the CrewAI side. The attack vector is network-based and returns internal HTTP response content back to the attacker through the AI agent's output.

python

# Security patch in docs_site_loader.py — replaces direct `requests` usage
# with a hardened wrapper that re-validates redirects and pinned addresses.
from crewai_tools.rag.base_loader import BaseLoader, LoaderResult
from crewai_tools.rag.source_content import SourceContent
from crewai_tools.security.safe_requests import safe_get


class DocsSiteLoader(BaseLoader):
    ...

Source: GitHub Commit 5d4851e

python

# Security patch in docx_loader.py — removes the vulnerable `requests`
# import in favor of the `safe_get` wrapper from crewai_tools.security.
import tempfile
from typing import Any

from crewai_tools.rag.base_loader import BaseLoader, LoaderResult
from crewai_tools.rag.source_content import SourceContent
from crewai_tools.security.safe_requests import safe_get


class DOCXLoader(BaseLoader):
    ...

Source: GitHub Commit 5d4851e

Detection Methods for CVE-2026-62240

Indicators of Compromise

Outbound HTTP requests from CrewAI hosts to 169.254.169.254, metadata.google.internal, or 100.100.100.200 (cloud metadata endpoints).
Agent scraping activity producing responses containing IAM tokens, instance identity documents, or private RFC1918 hostnames.
HTTP 3xx redirect chains initiated by CrewAI scraping tools that terminate at loopback or link-local addresses.

Detection Strategies

Monitor CrewAI process network egress for connections to link-local (169.254.0.0/16), loopback (127.0.0.0/8), and RFC1918 ranges.
Instrument the DocsSiteLoader and DOCXLoader classes to log the final resolved URL after redirects for anomaly analysis.
Correlate DNS query telemetry with subsequent connection destinations to identify DNS rebinding patterns from CrewAI hosts.

Monitoring Recommendations

Enable verbose HTTP client logging in CrewAI RAG loaders to capture redirect chains and final destinations.
Alert on any cloud metadata service access originating from workloads that host CrewAI agents.
Review agent output logs for leaked internal response bodies, especially JSON containing AccessKeyId or Token fields.

How to Mitigate CVE-2026-62240

Immediate Actions Required

Upgrade CrewAI to version 1.15.1 or later, which introduces the safe_get wrapper for all scraping fetches.
Inventory internal deployments for CrewAI RAG loader usage and prioritize patching internet-exposed agent services.
Rotate any cloud credentials, IAM role tokens, or internal service keys that could have been retrieved through the vulnerable metadata endpoints.

Patch Information

The vendor fix is included in CrewAI release 1.15.1, delivered by commit 5d4851eac797cafc45b726f65747fe2c9520fc42 and pull request #6331. The patch replaces direct requests usage in the RAG loaders with crewai_tools.security.safe_requests.safe_get, which validates redirect targets. See the CrewAI 1.15.1 Release Notes and the VulnCheck SSRF Advisory for full details.

Workarounds

Deploy CrewAI agents behind an egress proxy that blocks link-local, loopback, and RFC1918 destinations regardless of the initial DNS response.
Disable or wrap the affected scraping loaders (DocsSiteLoader, DOCXLoader) until the upgrade is applied.
Configure cloud instance metadata services to require IMDSv2 session tokens to reduce impact if metadata endpoints are reached.

bash

# Upgrade CrewAI to the patched version
pip install --upgrade 'crewai>=1.15.1'

# Verify the installed version
python -c "import crewai; print(crewai.__version__)"