CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)
CrewAI's retrieval-augmented generation (RAG) feature checks URLs before fetching them, but that check can be bypassed with tricks like URL encoding, mixed case, or unusual IP formats. An attacker who controls a RAG source URL can make the CrewAI server fetch internal addresses instead of a legitimate document.
How the attack works
An attacker supplies a RAG source URL that looks like it points to a normal external resource but is disguised using URL encoding, mixed-case text, or alternative IP notations (decimal, hex, or IPv6 loopback forms). CrewAI's URL validator fails to recognize these disguised forms as internal or restricted addresses and accepts the URL. CrewAI then makes an HTTP request to that address on the attacker's behalf. If the target is a cloud metadata endpoint (like AWS's 169.254.169.254) or an internal service, the attacker can read cloud credentials, probe internal APIs, or map out the private network.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8f491cb2-b5d7-49c3-a607-90ab8696ecc1
- Severity
- High
- CVEs
- CVE-2026-2286
Why it matters
Successful exploitation can expose cloud provider credentials, reveal internal network topology, or give an attacker a stepping stone into internal services that were never meant to be internet-reachable — all through a component meant only to fetch documents for AI retrieval.
What you can do
- →Restrict outbound network access from the CrewAI host so it cannot reach cloud metadata endpoints (169.254.169.254) or internal RFC-1918 ranges unless explicitly required.
- →Validate and allow-list RAG source URLs at the network or proxy layer, not just in application code, since application-side validators can be bypassed with encoding tricks.
- →Run CrewAI's RAG fetching in a network-isolated or sandboxed environment separate from services holding sensitive credentials.
- →Review logs for RAG requests containing encoded, hex, octal, or decimal IP representations, or repeated hits to loopback/link-local addresses, and treat these as suspicious unless explained by known testing activity.
Known benign look-alikes
- Security research tools probing SSRF bypass patterns for testing — rule fires by design.
- Security advisory text quoting CVE-2026-2286 SSRF payloads.
- Legitimate document URLs that contain the string '169' or '127' in path components — evaluate context.