Server-side Request Forgery (SSRF) Affecting crewai-tools package, versions [,1.15.1a1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-CREWAITOOLS-17962533
- published14 Jul 2026
- disclosed13 Jul 2026
- creditUnknown
Introduced: 13 Jul 2026
NewCVE-2026-62240 (opens in a new tab)How to fix?
Upgrade crewai-tools to version 1.15.1a1 or higher.
Overview
crewai-tools is a Set of tools for the crewAI framework
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the URL fetch logic in the scraping loaders and website scraping tools, including DocsSiteLoader, DOCXLoader, PDFLoader, load_from_url, WebPageLoader, ScrapeElementFromWebsiteTool, and ScrapeWebsiteTool. An attacker can access internal services or cloud metadata endpoints by supplying a URL that passes the initial check and then redirects to a private address, or by using DNS rebinding to make the fetch target resolve to an internal host after validation. The vulnerable code validates the starting URL once and then fetches it with requests.get, so redirect targets are not re-checked before the request is followed. From the user’s perspective, this lets a malicious URL fetch trigger requests from the CrewAI server to protected network locations and expose internal data.
Notes
DocsSiteLoader,DOCXLoader,PDFLoader, andload_from_urlall fetch arbitrary URLs with the same unauthenticated HTTP client path, so the bypass is not limited to a single loader class; any code path that uses those helpers inherits the redirect/DNS-rebinding issue.ScrapeWebsiteToolandScrapeElementFromWebsiteToolaccept a user-suppliedwebsite_urland pass through caller-provided headers/cookies, so deployments that attach session or API credentials to scraping requests can also leak those credentials if a redirect crosses to an attacker-controlled origin.