Loading story…
CrewAI disclosed and patched CVE-2026-62240, a high-severity server-side request forgery flaw in versions prior to 1.15.1 that affected scrape and URL-fetching features. The bug stemmed from validate_url performing a single hostname resolution and blocklist check before returning the original URL, while downstream requests.get calls could still follow attacker-controlled redirects to internal destinations. Reported impact included access to loopback addresses, RFC1918 space, and cloud metadata endpoints such as 169.254.169.254, creating a path to secret and credential exfiltration.
The fix was shipped in CrewAI 1.15.1 and implemented earlier in a GitHub patch that replaced direct fetches with a new safe_get helper across multiple loaders and website-scraping tools. The updated logic validates every redirect target, limits redirect chains, blocks redirects to internal resources, and strips sensitive headers and cookies on cross-origin redirects; accompanying tests verify that direct internal URLs and redirected internal URLs are denied while safe relative redirects remain allowed. Organizations using affected CrewAI releases are advised to upgrade to 1.15.1 or later and review any application flows that ingest external URLs.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-62240 was published as a high-severity SSRF vulnerability affecting CrewAI versions before 1.15.1. The advisory said attackers could bypass the validate_url protection through HTTP redirects or DNS rebinding to reach internal services and cloud metadata endpoints.
A public GitHub issue described how CrewAI scrape tools validated the initial hostname once but then followed redirects without re-validating the destination, enabling access to internal services and cloud metadata endpoints. The report also said the same design was vulnerable to DNS rebinding and included a proof of concept showing exfiltration of an internal secret via redirect to loopback.
CrewAI released version 1.15.1, and the release notes state it includes a fix for an SSRF redirect bypass in scraping fetches. Users were directed to upgrade to this version or later to remediate the issue.
A GitHub commit introduced safer request handling for CrewAI scraping and URL-fetching code, including redirect-by-redirect validation, redirect chain limits, and stripping sensitive headers on cross-origin redirects. The patch also replaced direct requests.get usage in multiple loaders and added tests covering blocked internal URLs and redirect abuse cases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026
Crawl4AI disclosed critical vulnerabilities in its Docker API server affecting versions `0.8.6` and earlier, including an AST sandbox escape in the computed fields feature that allowed **unauthenticated remote code execution** through the `/crawl` endpoint. The flaw let attackers abuse Python generator and frame attributes such as `gi_frame`, `f_back`, and `f_builtins` to reach `__import__` and run arbitrary OS commands inside the container. Additional reported weaknesses in the network-exposed API included unsafe code execution controls, server-side request forgery, missing authentication protections, hardcoded credentials, and improper path sanitization affecting endpoints including `/screenshot`, `/pdf`, `/crawl`, and `/execute_js`. The project patched the issues in version `0.8.7` by removing `eval()` from the computed-field execution path, replacing the prior underscore-based attribute blocklist with a stricter allowlist, tightening `_safe_eval_config`, and removing dangerous built-ins from the hook manager. The update also added path validation to stop traversal-style file writes and introduced adversarial security tests covering the reported exploit chains. Maintainers advised users to upgrade immediately, enable JWT authentication with `CRAWL4AI_API_TOKEN`, configure secrets securely, restrict network exposure of the Docker API, and disable JavaScript execution where it is not required.
Jun 29, 2026
Multiple vulnerabilities in **PraisonAI** and **praisonaiagents** exposed deployments to unauthorized access and server-side request forgery. **CVE-2026-55528** stems from `AgentServer` declaring an `auth_token` but not enforcing it on any route, allowing remote unauthenticated users to subscribe, publish, and invoke other actions even when authentication was configured. The issue affects PraisonAI versions earlier than **4.6.58** and praisonaiagents versions earlier than **1.6.58**, and was rated high severity with impact to integrity. Two SSRF flaws also affected the platform’s network-facing features. **CVE-2026-55526** allowed crafted hostnames such as `127.0.0.1.nip.io` to bypass hostname blocking because `spider_tools._host_is_blocked()` did not resolve hostnames before requests were made, enabling access to loopback and other internal resources. Separately, **CVE-2026-55537** exposed webhook handling to a DNS race and fail-open validation bug: an authenticated attacker with job submission rights and control of authoritative DNS could register a webhook that initially failed resolution, then repoint it before delivery so the background executor sent `HTTP POST` requests to internal targets including `127.0.0.1` and `169.254.169.254`. A hardening commit added authentication enforcement, DNS-based SSRF checks, and broader fail-closed validation, while fixes were released in updated PraisonAI and praisonaiagents versions.
Aug 25, 2026