# ZDI Published CrewAI as a 0-Day. There Is No Patch URL. > Trend's Zero Day Initiative published ZDI-26-706 on 16 September as a CrewAI 0-day. An unauthenticated attacker can reach code execution if a user loads a malicious agent configuration from a repository. ZDI's score is 8.8 with user interaction required. The report landed after ten months. ZDI lists no vendor patch. Stop loading agent configs from repositories you do not operate. Source: https://hackerlogs.com/blog/crewai-zdi-0day-rce Published: 2026-09-16 ## Key takeaways - ZDI-26-706: CrewAI load_agent_from_repository does not restrict a user-supplied argument before it imports a module. Code runs as the service account. - CVSS 8.8, AV:N AC:L PR:N UI:R. The user has to load the agent configuration. This is not an unauthenticated drive-by on a listening port. - ZDI reported it on 29 October 2025, followed up on 2 February 2026, and warned of 0-day publication on 2 April. The advisory landed 16 September with no patch URL. - This is not CERT VU#221883. Those earlier CrewAI rows, including the code-interpreter fallback, already have vendor statements and removals. - Until CrewAI ships a build ZDI will put on the advisory, the control is to stop repository loads. A community issue in April described the same class. US Google Trends on 16 September were still voter registration, iPhone, and football. The searchable operator ticket is [ZDI-26-706](https://www.zerodayinitiative.com/advisories/ZDI-26-706/), published this morning as a CrewAI 0-day. Score 8.8. User interaction required. No vendor patch URL. The X exclusive tonight is a May Hugging Face recon pass. This is the other host: an agent framework whose own load path imports what the repository names. Repository agent-load, unrestricted module import, code as the service account. Critical because ZDI shipped it as a 0-day after ten months, not because a listening port is open to the world. Three panels for ZDI-26-706: CrewAI loads an agent from a repository and imports a module without a restriction, Trend publishes an 8.8 0-day after ten months, and the only listed mitigation is to stop that load. ## What ZDI actually published. The 16 September advisory is titled as unsafe reflection in agent loading. The hole sits in load_agent_from_repository. The process does not properly restrict a user-supplied argument before it imports a module. An attacker who gets the user to load a malicious agent configuration from a repository can run code as the service account. ZDI's vector is 8.8: network, low complexity, no privileges, user interaction required, unchanged scope, high confidentiality, integrity, and availability. Credit: Peter Girnus, Demeng Chen, and Brandon Niemczyk. We are not reprinting the configuration that proves it. The operator fact is enough: if your users can load an agent from a repository you do not operate, ZDI says that load is in scope. > An April issue on the CrewAI repo described the same load-from-repository class and pointed at a fix PR. ZDI still published on 16 September as a 0-day and listed no patch URL. Until the advisory grows a vendor build, treat repository loads as open. The disclosure clock is long. ZDI reported the bug on 29 October 2025, asked the vendor to confirm receipt on 2 February 2026, and said it would publish as a 0-day on 2 April. The public advisory is 16 September. Mitigation, in ZDI's words: given the nature of the vulnerability, the only salient strategy is to restrict interaction with the product. ## Why this is not the CERT set. [VU#221883](https://www.kb.cert.org/vuls/id/221883) is a different bundle: CVE-2026-2275, 2285, 2286, and 2287. Code-interpreter fallback when Docker is missing, local file read, SSRF. CrewAI's vendor statement on that page says the interpreter was removed and path and URL checks were added. Those PRs do not close a 0-day ZDI dated today. Secondary write-ups are attaching CVE-2026-92206 to ZDI-26-706. We will take MITRE or NVD over a blog. File the ticket as ZDI-26-706 until a CVE record exists. > CrewAI is where teams keep the tools and keys the crew needs. A service-account shell on that host is a credential incident even when the user had to click load. Disable repository agent-load. Then rotate what that process could reach. ## What this is not. It is not unauthenticated without a user. UI is required. It is not [Langflow's scanner miss](/blog/langflow-cve-2026-12944), which is authenticated component validation with an IBM build number. It is not [GitSpawn](/blog/gitspawn-ai-agents-git-hijack). Different product, different load path. It is also not a license to keep loading agents from a marketplace you have not pinned. ZDI's mitigation is blunt because the hole is the load. ## What to do. If you run CrewAI, or you own the secrets that process can see: 1. Stop repository agent-load until CrewAI publishes a build ZDI will put on the advisory. ZDI's mitigation is restrict interaction. That is the ticket. 2. Inventory agents already pulled from repositories you do not operate. Delete anything nobody can explain. The hole is the load, not a new admin panel. 3. Hunt imports and child processes under the CrewAI service account since late October 2025. Rotate model-provider keys, database credentials, and any cloud role that process could reach. 4. Do not close this because you took the CERT interpreter and path-check PRs. Those are VU#221883. This is ZDI-26-706. 5. If you ship an agent catalog of your own, pin module names. A repository that can name any import is the [same class](/blog/langflow-cve-2026-12944) IBM just scored 9.6 on a different builder. The X debate tonight is a May recon pass on Hugging Face. The Google-searchable ticket is an agent framework whose load path still has no patch URL. Turn the load off. Then read the process as if someone already clicked it. ## Sources - [(0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-706/) (2026-09-16) - [VU#221883 - CrewAI contains multiple vulnerabilities including SSRF, RCE and local file read](https://www.kb.cert.org/vuls/id/221883) (2026-09-16) - [Remote Code Execution via Unvalidated Dynamic Module Import in crewAI](https://github.com/crewAIInc/crewAI/issues/5446) (2026-04-14) - [CrewAI Zero-Day RCE: Malicious Agents Execute Arbitrary Code via Repository](https://deafnews.it/en/news/ai/crewai-zero-day-rce-malicious-agents-execute-arbitrary-code-via-repository) (2026-09-16)