{"action":"Upgrade crewai-tools to 1.15.1 or later.","affected":[{"fixed":"1.15.1","introduced":"0"}],"component":"crewai-tools","cve_ids":["CVE-2026-62240"],"ecosystem":"PyPI","epss":0.0052,"exploited":false,"fixed_versions":["1.15.1"],"ghsa_id":"GHSA-mr4r-hcgx-8p4h","id":"tcs_01M5KFRJRDVEY0VG4FMC9RC36Q","modified_at":"2026-09-10T12:26:05.689476987Z","published_at":"2026-07-14T00:31:04Z","references":["https://osv.dev/vulnerability/GHSA-mr4r-hcgx-8p4h","https://nvd.nist.gov/vuln/detail/CVE-2026-62240","https://github.com/crewAIInc/crewAI/issues/6520","https://github.com/crewAIInc/crewAI/pull/6331","https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42","https://github.com/crewAIInc/crewAI","https://github.com/crewAIInc/crewAI/releases/tag/1.15.1","https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-mr4r-hcgx-8p4h","url":"https://osv.dev/vulnerability/GHSA-mr4r-hcgx-8p4h"}],"summary":"crewai-tools SSRF redirect bypass exposes internal services"}