VULNERABILITY INTELLIGENCE

CVE-2026-62240

CVSS score7.4 HIGH

EPSS probability0.52%

CISA KEVNot currently listed

Published2026-07-13

Last modified2026-10-24

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Description

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

Weakness classification

disclosure@vulncheck.com: CWE-918

Primary references

disclosure@vulncheck.com — Patch
disclosure@vulncheck.com — Exploit, Issue Tracking, Patch
disclosure@vulncheck.com — Exploit, Issue Tracking, Vendor Advisory
disclosure@vulncheck.com — Release Notes
disclosure@vulncheck.com — Third Party Advisory, VDB Entry