Vulnerability intelligence
CVE-2026-2286
CrewAI CrewAI
CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
0.5%
Riskier than 39% of all CVEs · checked 2026-09-09
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Mar 31, 2026 · latest Mar 31, 2026
Coverage timeline
-
CrewAI Vulnerabilities Expose Devices to Hackingwww.securityweek.com · Mar 31, 2026