{"id":"CVE-2026-120630","kind":"vulnerability","aliases":["CVE-2026-120630"],"related":[],"title":"CrewAI before 1.15.17: URL parser mismatch lets crafted URLs bypass the SSRF guard","description":"CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.","summary":"CrewAI's SSRF guard parses the URL with Python urlparse while the HTTP client (requests/urllib3) parses it differently. A URL such as http://127.0.0.1:8080\\@1.1.1.1/ passes the guard (which sees 1.1.1.1) but the client connects to 127.0.0.1. The researcher demonstrated this against ScrapeWebsiteTool. CVE record (CERT/CC) lists versions before 1.15.17 as affected; 1.15.17 validates the peer IP at connect time.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crewai","fixed":["1.15.17"],"affected":"< 1.15.17","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","crewai","python","scrapewebsitetool","ssrf"],"not_affected_if":["crewai-1.15.17-or-later","no-url-fetch-tools","no-url-fetching-tools","static-urls-only"],"how_to_check":"Run pip show crewai (and pip show crewai-tools); anything below 1.15.17 is affected. Then check whether any agent uses ScrapeWebsiteTool or other URL-fetching tools with URLs an untrusted party or prompt injection can influence. Also check other tools in crewai-tools that fetch URLs.","fix":"Upgrade to CrewAI 1.15.17 or later (pip install -U 'crewai>=1.15.17'); it pins SSRF checks to each redirect hop and the validated peer IP (PR #6981).","status":"open","published_at":"2026-11-02T18:18:52+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:34+00:00","updated_at":"2026-11-02T18:25:55+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-02T18:24:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CrewAI: SSRF guard and HTTP client let malicious URLs reach internal hosts","impact":"medium","summary":"CrewAI's SSRF guard and its HTTP client each check different parts of a URL, so a crafted URL passes the guard and is fetched anyway. An attacker who can get a URL into a request, such as through the ScrapWebsiteTool, can make the server request internal or otherwise blocked addresses.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["crewai","python","ai-agents","ssrf"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server makes requests to internal addresses, leaking internal data","analyst_note":"Find the affected and fixed CrewAI versions and the advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120630); the sources give no version ranges.","how_to_check":"- `pip show crewai` to see the installed CrewAI version\n- Check whether any agent uses ScrapWebsiteTool or other URL-fetching tools with input an untrusted party can influence\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-url-fetching-tools","static-urls-only"],"who_is_affected":"Teams running CrewAI agents that fetch URLs, especially through ScrapWebsiteTool, where URLs can come from user input or other untrusted content. The sources do not state which versions are affected or whether a configuration limits exposure, so unknown. Deployments that never fetch attacker-influenced URLs are likely lower exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4120,"output_tokens":624,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed CrewAI versions and the advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120630); the sources give no version ranges.","search":"'-120630':16A,19A '-2026':15A,18A '1.1.1.1':55B,61B '1.15.17':3A,80B,83B '127.0.0.1':53B,67B '8080':54B 'affect':82B 'agent':23B 'ai':22B,25B 'ai-ag':21B 'ai-tool':24B 'bypass':10A 'caus':96C 'cert/cc':76B 'check':112C 'client':44B,64B,103C 'connect':65B,89B 'contain':92C 'content':108C,114C 'craft':8A 'crewai':1A,20A,27B,31B,91C 'cve':14A,17A,74B 'demonstr':70B 'differ':48B 'enabl':118C 'guard':13A,34B,58B,100C 'http':43B,102C 'inject':122C 'ip':87B 'let':7A 'list':77B 'malici':107C,124C 'mismatch':6A 'miss':106C 'opposit':113C 'pars':35B,46B 'parser':5A 'pass':56B,115C 'peer':86B 'perform':127C 'python':28B,39B 'record':75B 'request':120C 'requests/urllib3':45B 'research':69B 'scrapewebsitetool':29B,73B 'scrapwebsitetool':133C 'see':60B 'ssrf':12A,30B,33B,94C,99C,128C 'time':90B 'tool':26B 'url':4A,9A,37B,50B,110C,125C 'urlpars':40B 'valid':84B 'version':78B 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Apps running CrewAI older than 1.15.17 whose agents fetch URLs (ScrapeWebsiteTool and similar) where the URL can come from a user, a web page the agent reads, or prompt injection. Such a URL can reach localhost, internal services and cloud metadata endpoints from your server. Teams not using URL-fetching tools, or with no untrusted input reaching them, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T18:25:55Z","by":"analyst","doc":"https://app.opencve.io/cve/CVE-2026-120630","run_id":1409}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["crewai"],"ptokens":["crewai"],"labels":["aiagents","aitooling","crewai","python","scrapewebsitetool","ssrf","unknown"],"first_public_at":"2026-11-02T18:18:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120630","severity":null,"published_at":"2026-11-02T18:18:52+00:00","modified_at":"2026-11-02T18:18:52+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120630:1409","url":null,"severity":null,"published_at":"2026-11-02T18:25:55+00:00","modified_at":"2026-11-02T18:25:55+00:00","first_seen_at":"2026-11-02T18:25:55+00:00","fetched_at":"2026-11-02T18:25:55+00:00","note":"CVE record (OpenCVE/CERT/CC) says affected <1.15.17; fix PR #6981 and release 1.15.17 read on GitHub; mechanism per researcher blog (badcast). No exploitation known; PoC is in the blog. Release notes don't mention the CVE; PR-to-CVE link comes from the CVE references. NVD page returned empty."}],"documents":[{"id":53323,"url":"https://github.com/crewAIInc/crewAI/pull/6981","title":"fix(tools): pin SSRF fetches to the validated peer IP (PR #6981)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":53324,"url":"https://github.com/crewAIInc/crewAI/releases/tag/1.15.17","title":"CrewAI 1.15.17 release","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":53325,"url":"https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/","title":"Bypassing SSRF Guards with Parser Confusion (badcast)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":53326,"url":"https://app.opencve.io/cve/CVE-2026-120630","title":"CVE-2026-120630 (CERT/CC CNA record via OpenCVE)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}