CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286) - ATR-2026-00547 (208a8914-0d06-5e59-8af2-f9e132ea4d65)
Detects CVE-2026-2286 (CVSS HIGH, CWE-918): CrewAI's RAG (retrieval-augmented generation) URL validator can be bypassed by URL encoding, mixed-case, or alternative representations (decimal IP, hex IP, IPv6 loopback, DNS rebinding shapes) to perform server-side request forgery against internal services on the CrewAI host network. The vulnerability is part of the CERT/CC VU#221883 advisory cluster (four CrewAI CVEs, 2026-03-30). An agent or tool input that passes a crafted RAG source URL causes CrewAI to make internal HTTP requests to metadata services (e.g., AWS IMDS 169.254.169.254), internal APIs, or services on private RFC-1918 ranges — enabling cloud credential theft, internal service enumeration, or lateral movement. Detection covers: (a) RAG source URLs containing SSRF bypass representations of loopback / link-local / private IP ranges; (b) URL-encoded, hex, octal, or decimal IP representations of internal addresses in RAG contexts; (c) CrewAI RAG with cloud metadata endpoint patterns (169.254.169.254); (d) Explicit CVE-2026-2286 / CrewAI SSRF framing.