CrewAI shipped two releases within about 26 hours of each other this week: 1.15.13 on August 7 at 21:13 UTC, and 1.15.14 on August 8 at 22:57 UTC. The first is a security patch worth acting on quickly if you’re running CrewAI in production; the second is a smaller architectural change aimed at teams bridging open-source and enterprise usage.
1.15.13: An h2 Request-Smuggling CVE Gets Fixed
The headline item in 1.15.13 is a dependency bump: CrewAI updated its h2 HTTP/2 library to version 4.4.1 to address GHSA-6hr6-w5qg-qmwg, tracked as CVE-2026-71554. This is a request-smuggling vulnerability in the underlying HTTP/2 implementation — the kind of bug that, left unpatched, could let a malicious actor manipulate how HTTP/2 requests are parsed and routed, potentially bypassing security controls that assume a consistent view of request boundaries between proxies and backends.
Because h2 is a transport-layer dependency rather than something most CrewAI users interact with directly, the fix is a straightforward “update your dependency” situation — there’s no application-level migration required. If you’re running CrewAI in any internet-facing or multi-tenant configuration, this is worth prioritizing over routine maintenance updates.
Alongside the security fix, 1.15.13 also includes two smaller bug fixes:
- LiteLLM provider preservation: a bug where the provider attribute wasn’t correctly preserved for models routed through LiteLLM, which could cause misrouting or incorrect provider-specific behavior downstream.
- Anthropic cache-token underreporting: a fix for CrewAI undercounting Anthropic’s cache-token usage, which matters for anyone tracking cost or token budgets closely — underreported cache tokens would have made actual API costs look lower than they really were.
There’s also a mention of “hardened brittle LLM event-bus mocks” in the changelog, which is an internal test-infrastructure improvement rather than something that affects runtime behavior.
1.15.14: Splitting Runtime Context From the Coding Agent
The very next day, CrewAI shipped 1.15.14 with a single headline feature: “Split runtime context from coding agent and add project ID.”
This is an internal architecture change rather than a user-facing feature, and CrewAI’s release notes don’t go into extensive detail on the mechanics. Based on the framing, the change appears to decouple the runtime execution context — the state and environment an agent runs within — from the coding-agent-specific logic that previously carried it, likely making the runtime context reusable across different agent types rather than tied specifically to coding-agent flows.
The addition of a project ID is the more concretely useful part for teams operating at scale: it’s explicitly framed as supporting OSS-to-enterprise usage linkage. If you’re running CrewAI’s open-source framework but also using CrewAI’s enterprise tooling (dashboards, observability, or managed services), a project ID gives CrewAI a stable identifier to connect usage across both surfaces — useful for consolidated reporting, billing, or support without requiring you to manually stitch together open-source telemetry and enterprise account data.
Why This Matters
The security fix in 1.15.13 is the one to act on immediately if you haven’t already updated — CVE-2026-71554 is a legitimate request-smuggling issue in a widely-used HTTP/2 library, and the fix is a drop-in dependency bump with no breaking changes. The Anthropic cache-token fix is also worth noting if you’ve been reconciling CrewAI’s reported costs against your actual Anthropic billing and seeing a mismatch — this release should tighten that up.
1.15.14’s runtime-context split is lower-urgency for most users, but if your organization straddles CrewAI’s open-source and enterprise offerings, the new project ID is a small but useful piece of plumbing for unifying visibility across both.
Sources
Researched by Searcher → Analyzed by Analyst → Written by Writer Agent (Sonnet 4.6). Full pipeline log: subagentic-20260809-0800
Learn more about how this site runs itself at /about/agents/