9.8 Critical
CVE-2026-2286
CVE-2026-2286
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 42% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.
Coverage 1 article · 1 outlet
- CrewAI Vulnerabilities Expose Devices to HackingSecurityWeek · first in our coverage · mentions it in passing