CVE-2026-2286 in CrewAI

الملخص

بحسب MITRE • 30/03/2026

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.

Once again VulDB remains the best source for vulnerability data.

• مسؤول: Certcc
• حجز: 10/02/2026
• إفشاء: 30/03/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-354214
• CPE: جاهز
• CWE: CWE-918 (مؤكد)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00058
• KEV: لا
• النشاطات: منخفض جدًا

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-2286
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-2286
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-2286/