{"id":"CVE-2026-92206","kind":"vulnerability","aliases":["CVE-2026-92206"],"related":[],"title":"CrewAI: agent loading from repository lets a malicious config run code","description":"CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.\n\nThe specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.","summary":"CrewAI's load_agent_from_repository function passes a user-supplied value into a module import without restricting it. An attacker who gets a team to load a malicious agent configuration from a repository can run code as the service account running CrewAI.","severity":"high","cvss":8.8,"epss":0.00455,"exploited":false,"exploited_at":null,"products":[{"name":"crewai","fixed":[],"affected":"unknown (reproduced on 1.12.2; PyPI latest 1.15.22 on 2026-09-17 reported unpatched)","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["agent-frameworks","ai-agents","ai-tooling","crewai","python","rce","supply-chain"],"not_affected_if":["auth-required","no-repository-agent-loading"],"how_to_check":"Run: pip show crewai. Then run: grep -rn 'from_repository\\|load_agent_from_repository' --include='*.py' . Only code that loads agents from the CrewAI repository is reachable; a plain local crew is not. In the installed crewai, check crewai/utilities/agent_utils.py: importlib.import_module(tool['module']) with no _is_trusted_tool_module / ALLOWED_TOOL_MODULE_PREFIXES check means it is unpatched.","fix":"No fixed release is confirmed (unknown). Until the vendor ships one, do not use from_repository with agent definitions you do not control, keep agent definitions in your own reviewed source, and run crews with least privilege and no secrets in the environment. Watch crewAIInc/crewAI for an allowlist fix like PR #5447 (crewai_tools. and crewai.tools. prefixes plus a BaseTool subclass check).","status":"open","published_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:00+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T22:33:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CrewAI: agent loading from repository lets a malicious config run code","impact":"high","summary":"CrewAI's load_agent_from_repository function passes a user-supplied value into a module import without restricting it. An attacker who gets a team to load a malicious agent configuration from a repository can run code as the service account running CrewAI.","category":"ai-tooling","who_cares":["crewai","python","ai-agents"],"confidence":0.6,"needs_auth":"no","worst_case":"Code runs as the CrewAI service account on the host","analyst_note":"Find which CrewAI versions are affected and fixed, and whether load_agent_from_repository is reachable in default configs; check the NVD and ZDI advisory pages for the patched version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-repository-agent-loading","auth-required"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":3106,"output_tokens":349,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find which CrewAI versions are affected and fixed, and whether load_agent_from_repository is reachable in default configs; check the NVD and ZDI advisory pages for the patched version.","search":"'-2026':13A,16A '-92206':14A,17A '28387':174C 'account':75B,169C 'affect':99C 'agent':2A,20B,24B,37B,64B,81C,120C,132C 'agent-framework':19B 'ai':23B,26B 'ai-ag':22B 'ai-tool':25B 'allow':91C 'arbitrari':96C 'argument':146C 'attack':55B,93C,155C 'chain':33B 'code':11A,71B,86C,97C,162C 'config':9A 'configur':65B,121C 'context':165C 'crewai':1A,18A,28B,34B,77B,78C,79C,102C,103C 'cve':12A,15A 'execut':87C,95C,161C 'exist':128C 'exploit':109C 'flaw':127C 'framework':21B,80C 'function':40B,135C 'get':57B 'import':50B,151C 'instal':100C 'interact':105C 'let':6A 'leverag':157C 'load':3A,36B,61B,82C,117C,131C 'malici':8A,63B,119C 'modul':49B,153C 'must':116C 'pass':41B 'process':137C 'proper':140C 'python':29B 'rce':30B 'reflect':84C 'remot':85C,92C 'repositori':5A,39B,68B,124C,134C 'requir':107C 'restrict':52B,141C 'run':10A,70B,76B 'servic':74B,168C 'specif':126C 'suppli':32B,45B,145C 'supply-chain':31B 'target':115C 'team':59B 'tool':27B 'unsaf':83C 'use':148C 'user':44B,104C,144C 'user-suppli':43B,143C 'valu':46B 'vulner':88C,90C,111C,159C 'within':129C 'without':51B 'zdi':172C 'zdi-can':171C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-92206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92206","severity":null,"published_at":"2026-10-21T18:17:31+00:00","modified_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92206:194","url":null,"severity":null,"published_at":"2026-10-23T22:17:03+00:00","modified_at":"2026-10-23T22:17:03+00:00","first_seen_at":"2026-10-23T22:17:03+00:00","fetched_at":"2026-10-23T22:17:03+00:00","note":"ZDI-26-706 is a 0-day (reported 2025-10-29, published 2026-09-16). It names no affected range and no fix. Public issue #5446 has a PoC against v1.12.2. The allowlist PR #5447 was closed unmerged, and main still imports tool[module] unvalidated per a WebFetch read, which was truncated in web-cli. No exploitation in the wild found. No social discussion searched."},{"source":"analyst","external_id":"CVE-2026-92206:250","url":null,"severity":null,"published_at":"2026-10-23T22:33:46+00:00","modified_at":"2026-10-23T22:33:46+00:00","first_seen_at":"2026-10-23T22:33:46+00:00","fetched_at":"2026-10-23T22:33:46+00:00","note":"No new sources since run 194. Triage re-ran at 22:33 and cleared my how-to-check and fix, so I restored them. I also dropped the auth-required tag, because ZDI rates it PR:N and the repo API response is the attacker input. Reachability: only code that uses from_repository / load_agent_from_repository is exposed, so plain local crews are not. The fixed version is still unknown, and PR #5447 was closed unmerged."},{"source":"epss","external_id":"CVE-2026-92206","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92206","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1367,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-706/","title":"ZDI-26-706: CrewAI load_agent_from_repository unsafe reflection RCE (0-day)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1368,"url":"https://github.com/crewAIInc/crewAI/issues/5446","title":"crewAI #5446: RCE via unvalidated dynamic module import (v1.12.2), with PoC","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1369,"url":"https://github.com/crewAIInc/crewAI/pull/5447","title":"crewAI PR #5447: allowlist fix for load_agent_from_repository (closed)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1370,"url":"https://pranava0x0.github.io/vibe-coding-security/advisories/2026-09-crewai-zdi-zero-day-agent-loading-cve-batch.html","title":"CrewAI unpatched ZDI zero-day and CVE batch (Vibe Coding Security)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}