{"data":{"id":"6bfe3ce4-b788-42f4-bcd0-d8fd389820dd","title":"CVE-2026-62240: CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs…","summary":"CVE-2026-62240 affects CrewAI before 1.15.1. The validate_url function performs one-shot DNS resolution and blocklist checks, then returns the original URL unchanged. Attackers can bypass this filter with URLs that redirect to internal addresses or through DNS rebinding, reaching internal services and cloud metadata endpoints.","solution":"Fixed in 1.15.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62240","publishedAt":"2026-07-13T22:16:52.117Z","cveId":"CVE-2026-62240","cweIds":["CWE-918"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["crewai-tools@< 1.15.1 (fixed: 1.15.1)"],"affectedPackageNames":["crewai-tools"],"affectedPackageRefs":["pypi:crewai-tools"],"affectedVendors":[],"affectedVendorsRaw":["CrewAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"CrewAI server-side request forgery in validate_url via redirects","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.0052,"epssCheckedAt":"2026-10-14T06:09:08.182Z","kevDateAdded":null,"advisoryAliases":["GHSA-mr4r-hcgx-8p4h"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:47.499Z","patchAvailable":true,"disclosureDate":"2026-07-13T22:16:52.117Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}