CVE-2026-62240: CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
Published Jul 13, 2026
·Updated
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
Affected Software
2 affected components
CrewAI CrewAI<1.15.1
CrewAI CrewAI<1.15.1
Remediation
Patch Available
Event History
Jul 13, 2026
CVE Published
via MITRE·09:04 PM
Data Sourced
via MITRE·09:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-62240?
CVE-2026-62240 has a high severity rating of 8.3.
2
How do I fix CVE-2026-62240?
To fix CVE-2026-62240, you should upgrade to CrewAI version 1.15.1 or later.
3
What type of vulnerability is described in CVE-2026-62240?
CVE-2026-62240 is a server-side request forgery (SSRF) vulnerability.
4
What impact does CVE-2026-62240 have on my system?
CVE-2026-62240 can allow attackers to bypass security filters and access internal resources.
5
Is there a patch available for CVE-2026-62240?
Yes, a patch is available in CrewAI version 1.15.1.