CVE-2026-2287

CVE-2026-2287 affects CrewAI tooling and is triggered when the Code Interpreter/ Docker runtime check fails. Several sources (NVD, Red Hat, CVE List, CERT, EUVD, PT Security, Snyk) describe that CrewAI does not reliably verify that Docker remains running during runtime and falls back to a sandbox...

CVE-2026-2286

CVE-2026-2286 affects CrewAI ecosystem through a server-side request forgery (SSRF) vulnerability in the RAG search tooling, enabling an attacker to access internal and cloud resources by supplying crafted URLs at runtime. Connected advisories confirm the vulnerability in the CrewAI stack, includ...

CVE-2026-62240

CVE-2026-62240 overview : CrewAI before 1.15.1 is affected by a server-side request forgery in the validate_url function, which performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. An attacker can bypass the security filter by providing URLs that redi...

CVE-2026-2285

CrewAI CVE-2026-2285 is an arbitrary local file read vulnerability in the JSON loader tool, caused by lack of path validation in the loader. Affected ecosystem details indicate affected crewai-tools transitive deps (crewai-tools >=0.13.2,