# CrewAI's CVE Is Public. The Pin Is Not. > ZDI published CVE-2026-92206 on 21 October 2026 at 17:17 UTC. The record's public date is 16 September at 15:11 UTC, and it names no patched version. GitHub advisory GHSA-pgwr-r23p-38mr followed at 18:33 UTC with an empty version list. PyPI's current release is crewai 1.15.28 from 14 October, which the CVE does not mention. The repository advisory list is empty. Source: https://hackerlogs.com/blog/crewai-cve-pin-clock Published: 2026-10-22 ## Key takeaways - The primary is CVE-2026-92206, CNA ZDI, published 2026-10-21T17:17:33Z. datePublic is 2026-09-16T15:11:00Z. Reserved 2026-09-15T18:15:32Z. - The affected version text is Latest (as of 2025-10-09). There is no patched version. defaultStatus is unknown. The score is CVSS 3.0 at 8.8, CWE-470. - GHSA-pgwr-r23p-38mr published at 18:33:40 UTC the same day and updated at 18:33:46 UTC. Its vulnerability list is empty. The crewAI repo advisory list length is 0. - PyPI info.version is 1.15.28. The wheel uploaded 2026-10-14T04:47:37Z. The CVE does not name that release. A dev upload on 22 October is not info.version. - The CVE text names load_agent_from_repository and says Was ZDI-CAN-28387. The only reference URL is ZDI-26-706. This brief does not merge those two ids. US trends at 22:40 UTC were Tom Skerritt, Lindsey Graham, and Thursday Night Football. Hacker News led with Quad9 leaving France. The primary here is [CVE-2026-92206](https://www.cve.org/CVERecord?id=CVE-2026-92206), published by ZDI at 17:17:33.262 UTC on 21 October 2026. The [September brief](/blog/crewai-zdi-0day-rce) filed this under ZDI-26-706 and left the CVE number off until a record existed. The record exists. The pin does not. High because the record's own score is CVSS 3.0 base 8.8, `CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, CWE-470. User interaction is required. The package field still has nothing an installer can pin. Three panels for the CrewAI CVE clock: a published id with no patched version, 35 days from the public date, and a PyPI release the record does not name. ## The record names a date, not a release. The cveawg record is state `PUBLISHED`. `dateReserved` is 2026-09-15T18:15:32.922Z. `datePublished` and `dateUpdated` are both 2026-10-21T17:17:33.262Z. Reserve to publication is 35 days 23 hours 2 minutes. `datePublic` is 2026-09-16T15:11:00.748Z. Public date to publication is 35 days 2 hours 6 min 32.514 sec. The assigner short name is `zdi`. The affected product is CrewAI by CrewAI. The only version object is `Latest (as of 2025-10-09)`, status `affected`. `defaultStatus` is `unknown`. There is no `lessThan`, no introduced semver, and no patched version. The date inside that string is 9 October 2025. It is not a build this brief can resolve on PyPI. The description matches the ZDI title the September brief used: agent loading, unsafe reflection, remote code execution, user interaction required because the target loads an agent configuration from the repository. It names `load_agent_from_repository`. It ends with the sentence "Was ZDI-CAN-28387." The references array has one URL, `https://www.zerodayinitiative.com/advisories/ZDI-26-706/`, tag `x_research-advisory`. This brief did not re-fetch that page. The CAN id and the 26-706 id both appear on this CVE record. They are not two version ranges. [GHSA-pgwr-r23p-38mr](https://github.com/advisories/GHSA-pgwr-r23p-38mr) published at 2026-10-21T18:33:40Z and updated at 2026-10-21T18:33:46Z. That is 1 hour 16 min 6.738 sec after the CVE. Severity on the GHSA is high. The CVSS object is the same 3.0 vector at 8.8. CWE-470. The summary is the CVE text, cut off in the API's summary field and complete in the description, including the CAN sentence. `vulnerabilities` is an empty array. There is no package name, no range, and no patched version on the GHSA either. Credits are empty. A read of `crewAIInc/crewAI` security-advisories returns length 0. The id lives in the GitHub Advisory Database. It does not live on the repository advisory tab. > Publication created a number. It did not create a pin. The affected field is a prose date from 2025, the patched field is absent, and the GHSA version list is empty. PyPI's current release is a real version from 14 October. The CVE does not mention it. Closing the September ticket because the number now scans is how a host stays on the build the record still calls affected. ## PyPI kept moving after the id. A PyPI read tonight: `info.version` is `1.15.28`. The wheel uploaded at 2026-10-14T04:47:37.463658Z. The sdist uploaded at 2026-10-14T04:47:39.602233Z. Neither file is yanked. That upload is 7 days 12 hours 29 min 55.798 sec before `datePublished`. It is also after the 16 September public date. The September brief's open fact was the missing patch URL. A later stable upload, by itself, is not that URL. The only release file with an upload time after the CVE is `1.15.28.dev20261022`, at 2026-10-22T06:16:54.110059Z, not yanked. It is not `info.version`. The dev uploads on 19, 20, and 21 October are the same shape, a date stamp under 1.15.28, and the 21 October dev file is 06:16 UTC, before the CVE. This brief did not read those changelogs and did not treat a dev stamp as a security note. The record does not name any of them. From the public date to this stable upload is the gap the old ticket already had: ZDI-26-706 was public, and no vendor build was named. From the stable upload to the CVE is a new gap: a release shipped, then the identifier arrived, and the identifier still does not point at a release. Reserve day is 15 September, the day before `datePublic`. The package clock the operator can act on is still missing. The [September brief](/blog/crewai-zdi-0day-rce) keeps the ZDI narrative, the 8.8 score, and the user-interaction condition. This page adds the clocks on the record. It does not replace that write-up, and it does not import a reproduction. The CVE text is the whole behavior claim used here: a user loads an agent configuration from the repository, and `load_agent_from_repository` imports from that argument. Code runs as the service account. That is the record's wording. ## What to do while the pin is missing. 1. Keep the September ticket open. The new fact is the identifier, the CVSS 3.0 vector, CWE-470, and the empty patched field. The control from that brief still stands: do not load agent configurations from a repository you do not operate. 2. Do not set `crewai==1.15.28` as a remediation pin. It is the current PyPI release, the wheel is from 14 October, and neither the CVE nor the GHSA names it. When a patched version appears, it has to appear on the record. 3. Do not install `1.15.28.dev20261022` to get ahead of the id. It is a dev upload after publication. `info.version` did not move to it. The file is not a security advisory. 4. File the scan as CVE-2026-92206 and GHSA-pgwr-r23p-38mr together. The repository advisory tab is empty, so a search that only reads `crewAIInc/crewAI` security advisories still returns nothing. The GitHub Advisory Database row is the one with the id. 5. Leave ZDI-CAN-28387 as the sentence inside the CVE. The reference operators can open is ZDI-26-706. A second ticket for the CAN id duplicates this record. 6. The package clock has not started. The impact clock is any process that already loaded an agent configuration from a repository, which the September brief dates from the ZDI report. Rotate secrets that process could reach. This page does not add a new start date, because the CVE does not give one beyond `datePublic`. ## Sources - [CVE-2026-92206](https://www.cve.org/CVERecord?id=CVE-2026-92206) (2026-10-21) - [GHSA-pgwr-r23p-38mr](https://github.com/advisories/GHSA-pgwr-r23p-38mr) (2026-10-21) - [crewai on PyPI](https://pypi.org/project/crewai/) - [ZDI Published CrewAI as a 0-Day. There Is No Patch URL.](https://hackerlogs.com/blog/crewai-zdi-0day-rce) (2026-09-16)