CrewAI 1.15.17 pins SSRF checks to every redirect hop and peer IP

GitHub (crewAIInc/crewAI)·medium signalXBlueskyLinkedInCopy link

Released 20 Aug 2026, CrewAI 1.15.17 fixes an SSRF gap where checks were not re-applied per redirect hop and peer IP, which is the classic bypass for a tool that fetches a URL an agent chose. It also stops using a URL hostname as the MCP HTTP and SSE `server_name`, attributes tool errors to the tool that actually failed rather than the caller, closes the agent scope on every failed attempt, and repairs native tool calls over the OpenAI Responses API. On the feature side, declarations can now drive conversational mode with synthesized built-in conversational methods.