# CVE-2026-120630: CrewAI server-side request forgery in ScrapWebsiteTool

Source: https://junglewise.ai/threats/cve-2026-120630-crewai-contains-an-ssrf-vulnerability-caused-by-its-ssrf-guard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120630 · Severity: info · Published 2026-11-02

CrewAI is a framework for building AI agent workflows. The ScrapWebsiteTool, used to fetch and parse website content, contained a server-side request forgery (SSRF) vulnerability where the security validation could be bypassed through URL manipulation or HTTP redirects, allowing an attacker to make the server access internal networks or restricted IP addresses.

Vendors: [crewAI](https://junglewise.ai/threats/vendors/crewai).

## Quick answers

**Is CVE-2026-120630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120630 being exploited in the wild.

**How severe is CVE-2026-120630?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** CrewAI before fix (PR #6981).

**Is there a fix for CVE-2026-120630?** A patch was published on 2026-08-17: PR #6981 merged Until you apply it: Set the environment variable CREWAI_TOOLS_FORCE_SAFE_PATHS to enforce strict path validation and disable unsafe paths, even if CREWAI_TOOLS_ALLOW_UNSAFE_PATHS is set. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120630?** Check whether you run CrewAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Set the environment variable CREWAI_TOOLS_FORCE_SAFE_PATHS to enforce strict path validation and disable unsafe paths, even if CREWAI_TOOLS_ALLOW_UNSAFE_PATHS is set.

## Technical details

The SSRF vulnerability existed in both the validation logic and HTTP client: the validator checked only the original URL string and missed malicious redirects, while DNS resolution and socket connection could happen to different IPs than what was validated. An attacker could inject a malicious URL or chain HTTP 302 redirects to internal addresses. The fix pins validation to each redirect hop and the actual peer IP using a custom SSRFProtectedAdapter that re-validates DNS and socket connection before each request.

## Affected products

- CrewAI CrewAI before fix (PR #6981)

## Timeline

- 2026-11-02: disclosed
- 2026-08-17: patched: PR #6981 merged

## References

- [https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool](https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool)
- [https://github.com/crewAIInc/crewAI/pull/6981](https://github.com/crewAIInc/crewAI/pull/6981)

## Related threats

- [CrewAI Framework unsafe reflection in agent loading remote code execution](https://junglewise.ai/threats/cve-2026-92206-crewai-crewai-framework-agent-loading-unsafe-reflection-remote)