CVE-2026-62240

Name of the Vulnerable Software and Affected Versions CrewAI versions prior to 1.15.1

Description A server-side request forgery (SSRF) issue exists in the validate url() function. The function performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. This allows attackers to bypass security filters by using URLs that redirect to internal addresses or by employing DNS rebinding—a technique where a DNS record is changed to point to a different IP address after the initial validation—to access internal services and cloud metadata endpoints.

Recommendations Update CrewAI to version 1.15.1 or later. As a temporary workaround, restrict the use of the validate url() function until the update is applied.