CVE-2026-2286

9.8 criticalEPSS 0.5%

Critical (9.8) in crewai crewai. EPSS 0.5% chance of exploitation in the next 30 days.

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

crewai:crewai

References

https://www.kb.cert.org/vuls/id/221883

Check your stack JSON