Dashboard / CVE-2026-62240

CVE-2026-62240

HIGH
MEDIUM Priority: 0.04 BB Relevance: 67/100
Published: 2026-07-13 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: High
VI: None
VA: None

Description

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
crewai crewai < 1.15.1

References & Advisories (5)

https://github.com/crewAIInc/crewAI/pull/6331
Exploit Issue Tracking Vendor Advisory

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

8.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.52%
Raw Score 0.005200
Percentile 44.0%
Date 2026-10-28

Intelligence Sources

nvd ref →

External Links