CVE-2026-62240: CrewAI SSRF filter bypass

CISO Take

CrewAI's validate_url function performs a single DNS lookup and blocklist check, then hands the original URL back to be fetched later — a classic time-of-check/time-of-use gap that lets an attacker's domain resolve to a benign public IP during validation and rebind to an internal address or the cloud metadata endpoint by the time the actual HTTP request fires. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this isn't under active exploitation today — but CrewAI is a widely deployed agent framework and any of its tools that fetch attacker-influenced URLs (scraping, browsing) inherit this gap, and a successful hit against AWS/GCP/Azure metadata services can hand over instance credentials in one shot. Scope is changed in the CVSS vector (S:C) precisely because impact isn't contained to the CrewAI process — it reaches whatever internal service or metadata endpoint the rebind targets. Patch to CrewAI 1.15.1 immediately; until then, enforce network-layer egress controls (block agent runtime egress to 169.254.169.254 and RFC1918 ranges, require IMDSv2 with hop-limit=1) since the app-layer filter cannot be trusted to survive DNS rebinding.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

High severity (CVSS 7.4) but not yet weaponized in the wild — no KEV entry, no EPSS data, no public PoC or scanner template. Attack complexity is low once a malicious low-TTL DNS record is set up, privileges required are none, but exploitation requires user interaction (a user or workflow must trigger the agent to fetch the attacker-controlled URL), which raises the bar slightly versus a fully remote, unauthenticated flaw. The confidentiality impact is high with scope change, meaning a successful DNS-rebind can leak data or credentials from systems well outside CrewAI's own trust boundary — this is the part that should worry CISOs running CrewAI agents inside cloud VPCs.

How does the attack unfold?

Entry point

Attacker gets a CrewAI agent's URL-fetching tool to target a domain they control, requiring some user interaction to trigger the fetch.

AML.T0053

Filter bypass

validate_url performs a one-time DNS resolution and blocklist check; the attacker's domain currently resolves to a benign public IP, so it passes.

AML.T0049

DNS rebinding

Before the actual HTTP fetch occurs, the attacker updates the low-TTL DNS record to point the domain at an internal address or the cloud metadata endpoint.

Impact

CrewAI's HTTP client fetches the rebound target and the response — potentially cloud credentials or internal service data — flows back through the agent to the attacker.

AML.T0086

Entry point

Attacker gets a CrewAI agent's URL-fetching tool to target a domain they control, requiring some user interaction to trigger the fetch.

AML.T0053

Filter bypass

validate_url performs a one-time DNS resolution and blocklist check; the attacker's domain currently resolves to a benign public IP, so it passes.

AML.T0049

DNS rebinding

Before the actual HTTP fetch occurs, the attacker updates the low-TTL DNS record to point the domain at an internal address or the cloud metadata endpoint.

Impact

CrewAI's HTTP client fetches the rebound target and the response — potentially cloud credentials or internal service data — flows back through the agent to the attacker.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
CrewAI	pip	—	No patch
57.8K 325 dependents Pushed yesterday 0% patched Full package profile →

Do you use CrewAI? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I None

A None

What should I do?

1 step

Upgrade to CrewAI >= 1.15.1, which fixes the TOCTOU gap in validate_url (see commit 5d4851e and PR #6331). Until patched, do not rely on the application-layer blocklist alone: enforce network segmentation so agent runtime hosts cannot reach 169.254.169.254 or RFC1918 ranges, require IMDSv2 with a hop limit of 1 on AWS to blunt SSRF-to-metadata attacks, and consider a forward proxy with DNS pinning/resolve-once-fetch-once semantics in front of any agent tool that performs outbound HTTP fetches. Detection: alert on outbound connections from agent hosts to link-local or private-range addresses immediately following a DNS resolution to a short-TTL domain, and review scrape/browsing tool call logs for URLs whose registered domain has an unusually short DNS TTL.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-2.3 - Risks are documented and monitored on an ongoing basis

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62240?

CrewAI's validate_url function performs a single DNS lookup and blocklist check, then hands the original URL back to be fetched later — a classic time-of-check/time-of-use gap that lets an attacker's domain resolve to a benign public IP during validation and rebind to an internal address or the cloud metadata endpoint by the time the actual HTTP request fires. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this isn't under active exploitation today — but CrewAI is a widely deployed agent framework and any of its tools that fetch attacker-influenced URLs (scraping, browsing) inherit this gap, and a successful hit against AWS/GCP/Azure metadata services can hand over instance credentials in one shot. Scope is changed in the CVSS vector (S:C) precisely because impact isn't contained to the CrewAI process — it reaches whatever internal service or metadata endpoint the rebind targets. Patch to CrewAI 1.15.1 immediately; until then, enforce network-layer egress controls (block agent runtime egress to 169.254.169.254 and RFC1918 ranges, require IMDSv2 with hop-limit=1) since the app-layer filter cannot be trusted to survive DNS rebinding.

Is CVE-2026-62240 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-62240, increasing the risk of exploitation.

How to fix CVE-2026-62240?

Upgrade to CrewAI >= 1.15.1, which fixes the TOCTOU gap in `validate_url` (see commit 5d4851e and PR #6331). Until patched, do not rely on the application-layer blocklist alone: enforce network segmentation so agent runtime hosts cannot reach 169.254.169.254 or RFC1918 ranges, require IMDSv2 with a hop limit of 1 on AWS to blunt SSRF-to-metadata attacks, and consider a forward proxy with DNS pinning/resolve-once-fetch-once semantics in front of any agent tool that performs outbound HTTP fetches. Detection: alert on outbound connections from agent hosts to link-local or private-range addresses immediately following a DNS resolution to a short-TTL domain, and review scrape/browsing tool call logs for URLs whose registered domain has an unusually short DNS TTL.

What systems are affected by CVE-2026-62240?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, web scraping/tool invocation pipelines, cloud-deployed agentic systems.

What is the CVSS score for CVE-2026-62240?

CVE-2026-62240 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworksweb scraping/tool invocation pipelinescloud-deployed agentic systems

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

Exploitation Scenario

An attacker registers a domain with a very short DNS TTL and initially points it at a benign public IP. They get a CrewAI-powered agent to fetch that URL — for example, by submitting it directly to a user-facing assistant, or via an indirect prompt injection that causes an agent's scraping tool to visit the link during a workflow. `validate_url` resolves the domain, sees a public IP, passes the blocklist check, and returns the original URL unchanged for later use. Before CrewAI's HTTP client actually issues the fetch, the attacker updates the DNS record (DNS rebinding) to point the same domain at `169.254.169.254` or an internal service IP. The fetch now lands on the metadata endpoint or internal system, and whatever it returns (instance credentials, internal API responses) flows back through the agent's output to the attacker.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.