CVE-2026-92206: CrewAI agent loading imports attacker-controlled code

Tracking: CVE-2026-92206
Severity: High (CVSS 3.1: 8.8)

Who is affected

CrewAI's affected repository agent-loading path. Exploitation requires the target to load a malicious agent configuration; the ZDI advisory does not specify a fixed version.

How the attack works

load_agent_from_repository uses a user-controlled argument to import a module without sufficient restrictions. A malicious agent definition can therefore cross from configuration into Python execution, with the service account's permissions.

The attacker needs the configuration to be loaded. The finding should not be described as an unauthenticated network request automatically executing on every CrewAI deployment.

What to do

1. Restrict interaction with the affected product and load agent definitions only from reviewed sources, following ZDI's mitigation guidance.
2. Review repository-based agent configurations before loading them. Keep the runtime isolated from unnecessary secrets, writable directories, and internal services.
3. Track the vendor and ZDI references for a confirmed fix. If a suspicious definition was loaded, investigate imports, child processes, and outbound activity.

Sources

• Original advisory or incident report