---
id: "CVE-2026-120630"
kind: "vulnerability"
aliases: ["CVE-2026-120630"]
title: "CrewAI before 1.15.17: URL parser mismatch lets crafted URLs bypass the SSRF guard"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "crewai", "fixed": ["1.15.17"], "affected": "< 1.15.17", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "crewai", "python", "scrapewebsitetool", "ssrf"]
not_affected_if: ["crewai-1.15.17-or-later", "no-url-fetch-tools", "no-url-fetching-tools", "static-urls-only"]
published_at: "2026-11-02T18:18:52+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:25:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120630", "first_seen_at": "2026-11-02T18:24:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T18:25:55+00:00"}]
---

# CrewAI before 1.15.17: URL parser mismatch lets crafted URLs bypass the SSRF guard

CrewAI's SSRF guard parses the URL with Python urlparse while the HTTP client (requests/urllib3) parses it differently. A URL such as http://127.0.0.1:8080\@1.1.1.1/ passes the guard (which sees 1.1.1.1) but the client connects to 127.0.0.1. The researcher demonstrated this against ScrapeWebsiteTool. CVE record (CERT/CC) lists versions before 1.15.17 as affected; 1.15.17 validates the peer IP at connect time.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:crewai affected < 1.15.17 fixed 1.15.17

## How to check

Run pip show crewai (and pip show crewai-tools); anything below 1.15.17 is affected. Then check whether any agent uses ScrapeWebsiteTool or other URL-fetching tools with URLs an untrusted party or prompt injection can influence. Also check other tools in crewai-tools that fetch URLs.

## Fix

Upgrade to CrewAI 1.15.17 or later (pip install -U 'crewai>=1.15.17'); it pins SSRF checks to each redirect hop and the validated peer IP (PR #6981).

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120630
- 2026-11-02T18:25:55+00:00 analyst — CVE record (OpenCVE/CERT/CC) says affected <1.15.17; fix PR #6981 and release 1.15.17 read on GitHub; mechanism per researcher blog (badcast). No exploitation known; PoC is in the blog. Release notes don't mention the CVE; PR-to-CVE link comes from the CVE references. NVD page returned empty.

## Documents

- [advisory] CVE-2026-120630 (CERT/CC CNA record via OpenCVE) https://app.opencve.io/cve/CVE-2026-120630
- [describes] Bypassing SSRF Guards with Parser Confusion (badcast) https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/
- [fix] fix(tools): pin SSRF fetches to the validated peer IP (PR #6981) https://github.com/crewAIInc/crewAI/pull/6981
- [fix] CrewAI 1.15.17 release https://github.com/crewAIInc/crewAI/releases/tag/1.15.17

## From the sources

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_