CVE-2026-120630: CrewAI SSRF guard parser

CISO Take

CrewAI has a server-side request forgery flaw where its SSRF guard and its HTTP client each validate the opposite part of a URL, so a crafted URL passes the check but is fetched from a different destination. Any request that can inject a URL into an agent tool, such as ScrapeWebsiteTool, can reach internal services, cloud metadata endpoints and other private network resources the agent host can see. There is no CVSS score, EPSS data, KEV listing or public exploit yet, so urgency rests on the 371 downstream dependents, the 5 other CVEs in this package and the fact that prompt injection can supply the URL without any authentication. Upgrade to a CrewAI release containing the fix from PR 6981, and until then restrict agent egress at the network layer and block access to metadata endpoints (IMDSv2 or equivalent).

Sources:NVDATLASbadcast.devdocs.crewai.comGitHub (crewAIInc/crewAI PR 6981)

What is the risk?

Provisional risk is medium to high; no official severity is assigned. Exploitability looks high because the URL can arrive via prompt injection or untrusted input, with no privileges needed. Impact depends on deployment: agents running in cloud environments with reachable metadata services or internal APIs face credential theft and internal reconnaissance. No known exploitation, KEV listing or public exploit exists at publication.

How does the attack unfold?

Initial Access

Attacker supplies a crafted URL via user input or indirect prompt injection in content the agent processes.

AML.T0051.001

Guard Bypass

The SSRF guard and HTTP client parse the URL differently, so the check passes while the client targets a different host.

AML.T0053

Internal Access

The agent tool fetches internal services or cloud metadata endpoints from the agent host.

AML.T0049

Impact

Responses containing internal data or credentials return to the LLM context and are exfiltrated to the attacker.

AML.T0086

Initial Access

Attacker supplies a crafted URL via user input or indirect prompt injection in content the agent processes.

AML.T0051.001

Guard Bypass

The SSRF guard and HTTP client parse the URL differently, so the check passes while the client targets a different host.

AML.T0053

Internal Access

The agent tool fetches internal services or cloud metadata endpoints from the agent host.

AML.T0049

Impact

Responses containing internal data or credentials return to the LLM context and are exfiltrated to the attacker.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
CrewAI	pip	—	No patch
60.4K371 dependentsPushed yesterday14% patched~66d to patchFull package profile →

Do you use CrewAI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade CrewAI to the release containing the fix from PR 6981 (see the v1.15.x docs and advisory); the affected and patched version ranges are not listed in the data, so confirm them before rolling out. 2) Enforce egress filtering at the network or proxy level, denying RFC1918, loopback and link-local ranges, including 169.254.169.254. 3) Require IMDSv2 or disable metadata access for agent workloads. 4) Run agents with least-privilege cloud roles and in isolated network segments. 5) Remove or restrict web-scraping tools for agents that handle untrusted input, and apply domain allowlists. 6) Detect by logging outbound requests from agent hosts and alerting on connections to internal or metadata addresses or on URLs with unusual authority or userinfo components.

How is it classified?

Data LeakagePrompt InjectionAuth BypassAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-120630?

CrewAI has a server-side request forgery flaw where its SSRF guard and its HTTP client each validate the opposite part of a URL, so a crafted URL passes the check but is fetched from a different destination. Any request that can inject a URL into an agent tool, such as ScrapeWebsiteTool, can reach internal services, cloud metadata endpoints and other private network resources the agent host can see. There is no CVSS score, EPSS data, KEV listing or public exploit yet, so urgency rests on the 371 downstream dependents, the 5 other CVEs in this package and the fact that prompt injection can supply the URL without any authentication. Upgrade to a CrewAI release containing the fix from PR 6981, and until then restrict agent egress at the network layer and block access to metadata endpoints (IMDSv2 or equivalent).

Is CVE-2026-120630 actively exploited?

No confirmed active exploitation of CVE-2026-120630 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-120630?

1) Upgrade CrewAI to the release containing the fix from PR 6981 (see the v1.15.x docs and advisory); the affected and patched version ranges are not listed in the data, so confirm them before rolling out. 2) Enforce egress filtering at the network or proxy level, denying RFC1918, loopback and link-local ranges, including 169.254.169.254. 3) Require IMDSv2 or disable metadata access for agent workloads. 4) Run agents with least-privilege cloud roles and in isolated network segments. 5) Remove or restrict web-scraping tools for agents that handle untrusted input, and apply domain allowlists. 6) Detect by logging outbound requests from agent hosts and alerting on connections to internal or metadata addresses or on URLs with unusual authority or userinfo components.

What systems are affected by CVE-2026-120630?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, web-scraping agent tools, cloud-hosted AI agents.

What is the CVSS score for CVE-2026-120630?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationweb-scraping agent toolscloud-hosted AI agents

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

Exploitation Scenario

An attacker plants a crafted URL in a web page, document or support ticket that a CrewAI research agent processes. The URL is built so the SSRF guard validates one host while the HTTP client resolves another, such as an internal address. The agent calls ScrapeWebsiteTool, the guard passes the request, and the client fetches an internal service or the cloud metadata endpoint. The response, which may contain temporary cloud credentials, is returned into the LLM context and exfiltrated through the agent output or a follow-up tool call.