---
id: "CVE-2026-92206"
kind: "vulnerability"
aliases: ["CVE-2026-92206"]
title: "CrewAI: agent loading from repository lets a malicious config run code"
severity: "high"
cvss: 8.8
epss: 0.00455
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "crewai", "fixed": [], "affected": "unknown (reproduced on 1.12.2; PyPI latest 1.15.22 on 2026-09-17 reported unpatched)", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["agent-frameworks", "ai-agents", "ai-tooling", "crewai", "python", "rce", "supply-chain"]
not_affected_if: ["auth-required", "no-repository-agent-loading"]
published_at: "2026-10-21T18:17:31+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92206", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:17:03+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:33:46+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92206", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# CrewAI: agent loading from repository lets a malicious config run code

CrewAI's load_agent_from_repository function passes a user-supplied value into a module import without restricting it. An attacker who gets a team to load a malicious agent configuration from a repository can run code as the service account running CrewAI.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:crewai affected unknown (reproduced on 1.12.2; PyPI latest 1.15.22 on 2026-09-17 reported unpatched) fixed ?

## How to check

Run: pip show crewai. Then run: grep -rn 'from_repository\|load_agent_from_repository' --include='*.py' . Only code that loads agents from the CrewAI repository is reachable; a plain local crew is not. In the installed crewai, check crewai/utilities/agent_utils.py: importlib.import_module(tool['module']) with no _is_trusted_tool_module / ALLOWED_TOOL_MODULE_PREFIXES check means it is unpatched.

## Fix

No fixed release is confirmed (unknown). Until the vendor ships one, do not use from_repository with agent definitions you do not control, keep agent definitions in your own reviewed source, and run crews with least privilege and no secrets in the environment. Watch crewAIInc/crewAI for an allowlist fix like PR #5447 (crewai_tools. and crewai.tools. prefixes plus a BaseTool subclass check).

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92206
- 2026-10-23T22:17:03+00:00 analyst — ZDI-26-706 is a 0-day (reported 2025-10-29, published 2026-09-16). It names no affected range and no fix. Public issue #5446 has a PoC against v1.12.2. The allowlist PR #5447 was closed unmerged, and main still imports tool[module] unvalidated per a WebFetch read, which was truncated in web-cli. No exploitation in the wild found. No social discussion searched.
- 2026-10-23T22:33:46+00:00 analyst — No new sources since run 194. Triage re-ran at 22:33 and cleared my how-to-check and fix, so I restored them. I also dropped the auth-required tag, because ZDI rates it PR:N and the repo API response is the attacker input. Reachability: only code that uses from_repository / load_agent_from_repository is exposed, so plain local crews are not. The fixed version is still unknown, and PR #5447 was closed unmerged.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92206

## Documents

- [advisory] ZDI-26-706: CrewAI load_agent_from_repository unsafe reflection RCE (0-day) https://www.zerodayinitiative.com/advisories/ZDI-26-706/
- [describes] CrewAI unpatched ZDI zero-day and CVE batch (Vibe Coding Security) https://pranava0x0.github.io/vibe-coding-security/advisories/2026-09-crewai-zdi-zero-day-agent-loading-cve-batch.html
- [mitigation] crewAI PR #5447: allowlist fix for load_agent_from_repository (closed) https://github.com/crewAIInc/crewAI/pull/5447
- [poc] crewAI #5446: RCE via unvalidated dynamic module import (v1.12.2), with PoC https://github.com/crewAIInc/crewAI/issues/5446

## From the sources

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.

The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_