CVE-2026-120630 in CrewAI
Summary
by MITRE • 11/02/2026
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The CrewAI framework contains a Server-Side Request Forgery vulnerability rooted in a flawed implementation of its security controls for outbound HTTP requests. This flaw arises from an inconsistency between two distinct components within the library: the SSRF guard mechanism and the underlying HTTP client used to execute network operations. The core issue is that these two components employ opposite or mismatched logic when validating URLs, creating a bypass vector where malicious content can slip through both checks without triggering a block. Specifically, while one component may filter out certain patterns of malicious input, the other fails to recognize them due to its different validation criteria, allowing an attacker who controls the URL input to force the application into making requests to arbitrary internal or external destinations.
This vulnerability is particularly dangerous because it affects tools within the CrewAI ecosystem that handle web interactions, such as the ScrapWebsiteTool. When a user provides a URL for scraping or processing, the framework does not adequately sanitize or validate this input against known malicious patterns before passing it to the HTTP client. An attacker can craft a specially designed URL that exploits the discrepancy between the guard and the client logic. For instance, if the SSRF guard checks for exact domain matches but allows certain IP address formats, while the HTTP client interprets those same formats differently or ignores them due to its own parsing rules, the request will proceed successfully. This enables the execution of Server-Side Request Forgery attacks where the server acts as a proxy for an attacker's requests.
The operational impact of this vulnerability is significant in environments where CrewAI processes untrusted user input. By leveraging SSRF, an attacker can potentially access internal services that are not exposed to the public internet, such as cloud metadata endpoints, internal databases, or administrative interfaces. This can lead to unauthorized data exfiltration, lateral movement within a network, or even remote code execution if combined with other vulnerabilities in backend systems. The ability to bypass security controls through logical inconsistencies rather than technical exploits makes this vulnerability difficult to detect using standard perimeter defenses that rely on simple allowlists or blocklists.
To mitigate this risk, developers should immediately update CrewAI to the latest patched version where these validation logic discrepancies have been resolved. In cases where an upgrade is not feasible, it is critical to implement strict input validation at the application layer before any URL is passed to CrewAI tools. This includes enforcing allowlists of permitted domains and rejecting all requests that attempt to resolve internal IP addresses or use non-standard protocols. Additionally, network-level controls such as egress filtering should be configured to restrict outbound connections from servers running CrewAI instances to only known trusted endpoints. Regular security audits focusing on URL parsing logic across integrated libraries are also recommended to prevent similar logical flaws in future updates.