CVE-2026-92206: CrewAI: unsafe reflection in agent loader enables RCE

AWAITING NVD

Published October 21, 2026

CISO Take

CVE-2026-92206 is an unsafe reflection flaw (CWE-470) in CrewAI's load_agent_from_repository function: a user-supplied argument is used to import a module without restriction, so a malicious agent configuration pulled from a repository can execute arbitrary code as the service account. Exploitation requires user interaction (loading the attacker-controlled agent config), which limits mass exploitation, but the supply-chain angle is serious given about 360 downstream dependents and 3 other CVEs already recorded in the same package. No CVSS, EPSS, or KEV data exists yet, no public exploit or Nuclei template is known, and no patched version has been identified, so urgency should be driven by exposure rather than scores. Until a fix ships, restrict agent loading to vetted, internally controlled repositories, run CrewAI under a least-privileged, sandboxed service account, and watch the ZDI advisory (ZDI-26-706) for a patched release.

Sources:NVDzerodayinitiative.comATLAS

What is the risk?

Moderate to high pending scoring. Impact is full code execution in the service account context (high confidentiality, integrity and availability impact). Exploitation needs the victim to load a malicious agent configuration, which lowers likelihood, but agent repositories and shared configs are a natural supply-chain channel. No known public exploit, KEV listing, or EPSS data as of publication; the advisory comes from Zero Day Initiative (ZDI-CAN-28387), so details are credible. Confidence: MEDIUM, since severity and fix versions are unpublished.

How does the attack unfold?

Malicious agent config staged

Attacker publishes or tampers with an agent repository entry containing a crafted module reference.

AML.T0010.001

Victim loads agent

A user or pipeline calls load_agent_from_repository on the malicious configuration.

AML.T0011

Unsafe reflection

CrewAI imports the attacker-controlled module without restriction, running arbitrary code.

AML.T0050

Impact

Attacker steals API keys and secrets and pivots using the service account's access.

Malicious agent config staged

Attacker publishes or tampers with an agent repository entry containing a crafted module reference.

AML.T0010.001

Victim loads agent

A user or pipeline calls load_agent_from_repository on the malicious configuration.

AML.T0011

Unsafe reflection

CrewAI imports the attacker-controlled module without restriction, running arbitrary code.

AML.T0050

Impact

Attacker steals API keys and secrets and pivots using the service account's access.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
CrewAI	pip	—	No patch
60.1K365 dependentsPushed 8d ago17% patched~66d to patchFull package profile →

Do you use CrewAI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check the ZDI-26-706 advisory and CrewAI release notes and upgrade to a patched version as soon as one is available (none identified at publication). 2) Do not call load_agent_from_repository with untrusted or user-influenced repository references or agent names; allowlist repositories and module paths. 3) Review and pin agent configurations in version control and require code review for changes. 4) Run CrewAI in containers or sandboxes with least-privilege service accounts, minimal secrets, and restricted egress. 5) Detect: monitor for unexpected module imports, child processes spawned by the CrewAI process, and outbound connections from agent hosts; inventory CrewAI use via SBOM or pip freeze.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAML.T0010.001- AI Software AML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-92206?

Is CVE-2026-92206 actively exploited?

No confirmed active exploitation of CVE-2026-92206 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92206?

1) Check the ZDI-26-706 advisory and CrewAI release notes and upgrade to a patched version as soon as one is available (none identified at publication). 2) Do not call load_agent_from_repository with untrusted or user-influenced repository references or agent names; allowlist repositories and module paths. 3) Review and pin agent configurations in version control and require code review for changes. 4) Run CrewAI in containers or sandboxes with least-privilege service accounts, minimal secrets, and restricted egress. 5) Detect: monitor for unexpected module imports, child processes spawned by the CrewAI process, and outbound connections from agent hosts; inventory CrewAI use via SBOM or pip freeze.

What systems are affected by CVE-2026-92206?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, agent repositories and configuration loading, CI/CD pipelines for AI agents.

What is the CVSS score for CVE-2026-92206?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationagent repositories and configuration loadingCI/CD pipelines for AI agents

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.

Exploitation Scenario

An attacker publishes or compromises an agent repository or shared configuration containing a crafted module reference. A developer or automated pipeline using CrewAI loads that agent through load_agent_from_repository. The unrestricted argument causes CrewAI to import an attacker-chosen module, executing attacker code in the service account context. The attacker then harvests LLM provider keys and environment secrets, establishes persistence, and pivots into connected data stores and tools.

Weaknesses (CWE)

CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

[Architecture and Design] Refactor your code to avoid using reflection.
[Architecture and Design] Do not use user-controlled inputs to select and load classes or code.

Source: MITRE CWE corpus.