{"action":"Upgrade crewai-tools to 1.15.1 or later.","affected":[{"fixed":"1.15.1","introduced":"0"}],"component":"crewai-tools","cve_ids":["CVE-2026-62240"],"ecosystem":"PyPI","epss":0.0052,"exploited":false,"fixed_versions":["1.15.1"],"ghsa_id":"GHSA-mr4r-hcgx-8p4h","id":"tcs_01M5KH7YZXTYX47PK9SV1VAWFN","modified_at":"2026-09-10T12:15:05.550772476Z","published_at":"2026-09-10T09:44:50.523376Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3819","https://nvd.nist.gov/vuln/detail/CVE-2026-62240","https://github.com/crewAIInc/crewAI/issues/6520","https://github.com/crewAIInc/crewAI/pull/6331","https://github.com/crewAIInc/crewAI/commit/5d4851eac797cafc45b726f65747fe2c9520fc42","https://github.com/crewAIInc/crewAI","https://github.com/crewAIInc/crewAI/releases/tag/1.15.1","https://www.vulncheck.com/advisories/crewai-ssrf-filter-bypass-via-http-redirect-in-scrape-tools","https://pypi.org/project/crewai-tools","https://github.com/advisories/GHSA-mr4r-hcgx-8p4h"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-3819","url":"https://osv.dev/vulnerability/PYSEC-2026-3819"}],"summary":"crewai-tools SSRF redirect bypass exposes internal services"}