CVE-2026-62240
🟡 Monitoruj
Wykorzystanie podatności SSRF w CrewAI pozwala atakującym na dostęp do wewnętrznych usług.
CVSS
7.4
EPSS
0.5%
Exploit
poc
Vendor
crewai
Opis źródłowy (NVD)
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
exploit ssrf
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.4 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.5% |
| Opublikowano (NVD) | 2026-07-13 22:16:52 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-17 18:16:56 UTC |
Referencje
- https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42 ([email protected]) [Patch]
- https://github.com/crewAIInc/crewAI/issues/6520 ([email protected]) [Exploit, Issue Tracking, Patch]
- https://github.com/crewAIInc/crewAI/pull/6331 ([email protected]) [Exploit, Issue Tracking, Vendor Advisory]
- https://github.com/crewAIInc/crewAI/releases/tag/1.15.1 ([email protected]) [Release Notes]
- https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools ([email protected]) [Third Party Advisory, VDB Entry]