CVE-2026-120630

CrewAI scraping tools can bypass outbound URL restrictions

CrewAI · CrewAI web scraping

First documented disclosure · Review checkpoint

Summary

URL handling can bypass the agent's outbound request policy.

Severity and exploitation evidence

Critical · 9.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The outbound guard and the HTTP client interpreted some destination strings differently.

Conditions required

An application must pass an untrusted URL to an affected CrewAI tool and allow outbound requests.

Potential impact

The tool can send a request to private network destinations available from the agent host.

Affected versions and configurations

Before 1.15.17.

Fix and mitigation status

1.15.17 per CNA boundary.

Practical next steps

Update to 1.15.17 or later and enforce network-level egress restrictions.

Operating lesson

Ensure URL validation and connection establishment agree on the destination.

Evidence and limits

The August maintainer change precedes the September researcher account and November CVE. The CVSS 3.1 score shown comes from CISA enrichment. CERT/CC does not supply a score.

Sources