by Kastro
Paper/Archive/CVE-2026-2286

CVE-2026-2286

CrewAI CrewAI — CVE-2026-2286

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.8.438 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.

Affected

ProductAffectedFixed inSource
CrewAI1.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refkb.cert.org/vuls/id/221883