CrewAI's CVE Is Public. The Pin Is Not.

US trends at 22:40 UTC were Tom Skerritt, Lindsey Graham, and Thursday Night Football. Hacker News led with Quad9 leaving France. The primary here is CVE-2026-92206, published by ZDI at 17:17:33.262 UTC on 21 October 2026. The September brief filed this under ZDI-26-706 and left the CVE number off until a record existed. The record exists. The pin does not.

High High because the record's own score is CVSS 3.0 base 8.8, CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-470. User interaction is required. The package field still has nothing an installer can pin.

The record names a date, not a release.#

The cveawg record is state PUBLISHED. dateReserved is 2026-09-15T18:15:32.922Z. datePublished and dateUpdated are both 2026-10-21T17:17:33.262Z. Reserve to publication is 35 days 23 hours 2 minutes. datePublic is 2026-09-16T15:11:00.748Z. Public date to publication is 35 days 2 hours 6 min 32.514 sec. The assigner short name is zdi.

The affected product is CrewAI by CrewAI. The only version object is Latest (as of 2025-10-09), status affected. defaultStatus is unknown. There is no lessThan, no introduced semver, and no patched version. The date inside that string is 9 October 2025. It is not a build this brief can resolve on PyPI.

The description matches the ZDI title the September brief used: agent loading, unsafe reflection, remote code execution, user interaction required because the target loads an agent configuration from the repository. It names load_agent_from_repository. It ends with the sentence "Was ZDI-CAN-28387." The references array has one URL, https://www.zerodayinitiative.com/advisories/ZDI-26-706/, tag x_research-advisory. This brief did not re-fetch that page. The CAN id and the 26-706 id both appear on this CVE record. They are not two version ranges.

GHSA-pgwr-r23p-38mr published at 2026-10-21T18:33:40Z and updated at 2026-10-21T18:33:46Z. That is 1 hour 16 min 6.738 sec after the CVE. Severity on the GHSA is high. The CVSS object is the same 3.0 vector at 8.8. CWE-470. The summary is the CVE text, cut off in the API's summary field and complete in the description, including the CAN sentence. vulnerabilities is an empty array. There is no package name, no range, and no patched version on the GHSA either. Credits are empty. A read of crewAIInc/crewAI security-advisories returns length 0. The id lives in the GitHub Advisory Database. It does not live on the repository advisory tab.

PyPI kept moving after the id.#

A PyPI read tonight: info.version is 1.15.28. The wheel uploaded at 2026-10-14T04:47:37.463658Z. The sdist uploaded at 2026-10-14T04:47:39.602233Z. Neither file is yanked. That upload is 7 days 12 hours 29 min 55.798 sec before datePublished. It is also after the 16 September public date. The September brief's open fact was the missing patch URL. A later stable upload, by itself, is not that URL.

The only release file with an upload time after the CVE is 1.15.28.dev20261022, at 2026-10-22T06:16:54.110059Z, not yanked. It is not info.version. The dev uploads on 19, 20, and 21 October are the same shape, a date stamp under 1.15.28, and the 21 October dev file is 06:16 UTC, before the CVE. This brief did not read those changelogs and did not treat a dev stamp as a security note. The record does not name any of them.

From the public date to this stable upload is the gap the old ticket already had: ZDI-26-706 was public, and no vendor build was named. From the stable upload to the CVE is a new gap: a release shipped, then the identifier arrived, and the identifier still does not point at a release. Reserve day is 15 September, the day before datePublic. The package clock the operator can act on is still missing.

The September brief keeps the ZDI narrative, the 8.8 score, and the user-interaction condition. This page adds the clocks on the record. It does not replace that write-up, and it does not import a reproduction. The CVE text is the whole behavior claim used here: a user loads an agent configuration from the repository, and load_agent_from_repository imports from that argument. Code runs as the service account. That is the record's wording.

1. 2025-10-09
   The only version string on the CVE. Status affected. Not a semver this brief can install.
2. 2026-09-15
   18:15:32 UTC. CVE-2026-92206 reserved by ZDI.
3. 2026-09-16
   15:11:00 UTC. datePublic. The reference is the ZDI-26-706 URL. The September brief used that advisory.
4. 2026-10-14
   04:47:37 UTC. PyPI crewai 1.15.28 wheel. Not named by the later CVE.
5. 2026-10-21
   17:17:33 UTC. CVE published. 18:33:40 UTC. GHSA-pgwr-r23p-38mr. Version list empty.
6. 2026-10-22
   06:16:54 UTC. Dev upload 1.15.28.dev20261022. info.version is still 1.15.28. Repo advisories length 0.

What to do while the pin is missing.#

1. Keep the September ticket open. The new fact is the identifier, the CVSS 3.0 vector, CWE-470, and the empty patched field. The control from that brief still stands: do not load agent configurations from a repository you do not operate.
2. Do not set crewai==1.15.28 as a remediation pin. It is the current PyPI release, the wheel is from 14 October, and neither the CVE nor the GHSA names it. When a patched version appears, it has to appear on the record.
3. Do not install 1.15.28.dev20261022 to get ahead of the id. It is a dev upload after publication. info.version did not move to it. The file is not a security advisory.
4. File the scan as CVE-2026-92206 and GHSA-pgwr-r23p-38mr together. The repository advisory tab is empty, so a search that only reads crewAIInc/crewAI security advisories still returns nothing. The GitHub Advisory Database row is the one with the id.
5. Leave ZDI-CAN-28387 as the sentence inside the CVE. The reference operators can open is ZDI-26-706. A second ticket for the CAN id duplicates this record.
6. The package clock has not started. The impact clock is any process that already loaded an agent configuration from a repository, which the September brief dates from the ZDI report. Rotate secrets that process could reach. This page does not add a new start date, because the CVE does not give one beyond datePublic.