// hackerlogs
login+ register
Agentic AILLM AppSecSupply ChainThreat BriefCritical

ZDI Published CrewAI as a 0-Day. There Is No Patch URL.

ZDI-26-706 is an 8.8 CrewAI agent-load RCE disclosed 16 September. User interaction is required. ZDI's mitigation is to restrict interaction. No vendor patch URL.

Ajain Vivek · Editor, hackerlogs3 min readPractitioner

The short answer

Trend's Zero Day Initiative published ZDI-26-706 on 16 September as a CrewAI 0-day. An unauthenticated attacker can reach code execution if a user loads a malicious agent configuration from a repository. ZDI's score is 8.8 with user interaction required. The report landed after ten months. ZDI lists no vendor patch. Stop loading agent configs from repositories you do not operate.

Key takeaways

  • ZDI-26-706: CrewAI load_agent_from_repository does not restrict a user-supplied argument before it imports a module. Code runs as the service account.
  • CVSS 8.8, AV:N AC:L PR:N UI:R. The user has to load the agent configuration. This is not an unauthenticated drive-by on a listening port.
  • ZDI reported it on 29 October 2025, followed up on 2 February 2026, and warned of 0-day publication on 2 April. The advisory landed 16 September with no patch URL.
  • This is not CERT VU#221883. Those earlier CrewAI rows, including the code-interpreter fallback, already have vendor statements and removals.
  • Until CrewAI ships a build ZDI will put on the advisory, the control is to stop repository loads. A community issue in April described the same class.

US Google Trends on 16 September were still voter registration, iPhone, and football. The searchable operator ticket is ZDI-26-706, published this morning as a CrewAI 0-day. Score 8.8. User interaction required. No vendor patch URL.

The X exclusive tonight is a May Hugging Face recon pass. This is the other host: an agent framework whose own load path imports what the repository names.

Critical Repository agent-load, unrestricted module import, code as the service account. Critical because ZDI shipped it as a 0-day after ten months, not because a listening port is open to the world.

Three panels for ZDI-26-706: CrewAI loads an agent from a repository and imports a module without a restriction, Trend publishes an 8.8 0-day after ten months, and the only listed mitigation is to stop that load.

What ZDI actually published.#

The 16 September advisory is titled as unsafe reflection in agent loading. The hole sits in load_agent_from_repository. The process does not properly restrict a user-supplied argument before it imports a module. An attacker who gets the user to load a malicious agent configuration from a repository can run code as the service account.

ZDI's vector is 8.8: network, low complexity, no privileges, user interaction required, unchanged scope, high confidentiality, integrity, and availability. Credit: Peter Girnus, Demeng Chen, and Brandon Niemczyk.

We are not reprinting the configuration that proves it. The operator fact is enough: if your users can load an agent from a repository you do not operate, ZDI says that load is in scope.

The disclosure clock is long. ZDI reported the bug on 29 October 2025, asked the vendor to confirm receipt on 2 February 2026, and said it would publish as a 0-day on 2 April. The public advisory is 16 September. Mitigation, in ZDI's words: given the nature of the vulnerability, the only salient strategy is to restrict interaction with the product.

Why this is not the CERT set.#

VU#221883 is a different bundle: CVE-2026-2275, 2285, 2286, and 2287. Code-interpreter fallback when Docker is missing, local file read, SSRF. CrewAI's vendor statement on that page says the interpreter was removed and path and URL checks were added. Those PRs do not close a 0-day ZDI dated today.

Secondary write-ups are attaching CVE-2026-92206 to ZDI-26-706. We will take MITRE or NVD over a blog. File the ticket as ZDI-26-706 until a CVE record exists.

  1. ZDI reports the agent-load import hole to CrewAI.
  2. ZDI follows up and asks the vendor to confirm receipt.
  3. ZDI tells the vendor it intends to publish as a 0-day. A public GitHub issue describes the same class on 14 April.
  4. ZDI-26-706 goes public. No vendor patch URL. Aggregators start attaching CVE-2026-92206.

What this is not.#

It is not unauthenticated without a user. UI is required. It is not Langflow's scanner miss, which is authenticated component validation with an IBM build number. It is not GitSpawn. Different product, different load path.

It is also not a license to keep loading agents from a marketplace you have not pinned. ZDI's mitigation is blunt because the hole is the load.

What to do.#

If you run CrewAI, or you own the secrets that process can see:

  1. Stop repository agent-load until CrewAI publishes a build ZDI will put on the advisory. ZDI's mitigation is restrict interaction. That is the ticket.
  2. Inventory agents already pulled from repositories you do not operate. Delete anything nobody can explain. The hole is the load, not a new admin panel.
  3. Hunt imports and child processes under the CrewAI service account since late October 2025. Rotate model-provider keys, database credentials, and any cloud role that process could reach.
  4. Do not close this because you took the CERT interpreter and path-check PRs. Those are VU#221883. This is ZDI-26-706.
  5. If you ship an agent catalog of your own, pin module names. A repository that can name any import is the same class IBM just scored 9.6 on a different builder.

The X debate tonight is a May recon pass on Hugging Face. The Google-searchable ticket is an agent framework whose load path still has no patch URL. Turn the load off. Then read the process as if someone already clicked it.

Frequently asked

Is there a CVE number?

ZDI's public identifier is ZDI-26-706. Some secondary write-ups attach CVE-2026-92206. We are filing the ticket under ZDI's ID until MITRE or NVD shows a record. The operator fact does not change with the number: repository agent-load, user interaction, no patch URL.

Does this hit us if we never browse the public internet from CrewAI?

The user still has to load an agent configuration from a repository. An internal catalog, a Plus-style API, or a cloned agent pack is enough if that load path is on. ZDI's only listed mitigation is to restrict interaction with the product. Turn the repository load off until a patched build exists.

Is this the CERT CrewAI set from earlier this year?

No. VU#221883 covers CVE-2026-2275, 2285, 2286, and 2287: code-interpreter fallback, file read, and SSRF. CrewAI removed the interpreter and added path and URL checks. ZDI-26-706 is a later 0-day on agent loading from a repository. Do not close this ticket because you took those earlier PRs.

What should we hunt?

Agent configurations loaded from repositories you do not operate, especially since 29 October 2025 when ZDI says it first reported. Unexpected modules imported by the CrewAI process. New child processes under the service account. Rotate secrets that process could reach. We are not printing the load that proves it.

Sources

Related