CVE-2026-2286

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cret@cert.org

Published

2026-03-30

Last modified

2026-04-01

Weaknesses

CWE-918

Affected products

• Crewai (Crewai)

References

• https://www.kb.cert.org/vuls/id/221883