CVE-2026-62240: CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one

CrewAI versions before 1.15.1 have a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in the validate_url function. Attackers can bypass security checks by using URL redirects or DNS rebinding techniques (methods that change where a domain points to after an initial lookup) to access internal services and cloud metadata that should be blocked.