Live › vulnerability › CVE-2026-120630
CrewAI's SSRF guard parses the URL with Python urlparse while the HTTP client (requests/urllib3) parses it differently. A URL such as http://127.0.0.1:8080\@1.1.1.1/ passes the guard (which sees 1.1.1.1) but the client connects to 127.0.0.1. The researcher demonstrated this against ScrapeWebsiteTool. CVE record (CERT/CC) lists versions before 1.15.17 as affected; 1.15.17 validates the peer IP at connect time.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Apps running CrewAI older than 1.15.17 whose agents fetch URLs (ScrapeWebsiteTool and similar) where the URL can come from a user, a web page the agent reads, or prompt injection. Such a URL can reach localhost, internal services and cloud metadata endpoints from your server. Teams not using URL-fetching tools, or with no untrusted input reaching them, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| crewai | pypi | < 1.15.17 | 1.15.17 |
pip show crewai (and pip show crewai-tools anything below 1.15.17 is affectedUpgrade to CrewAI 1.15.17 or later (pip install -U crewai>=1.15.17); it pins SSRF checks to each redirect hop and the validated peer IP (PR #6981).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
This page as .md · .json · in your agent: get_signal("CVE-2026-120630")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.