CVE-2026-112308: CrewAI SSRF — HIGH

CISO Take

crewai-tools through 1.15.28 ships a SeleniumScrapingTool that skips the validate_url private-address check, so an attacker who can steer agent tool input (for example via prompt injection in content the agent reads) can make headless Chrome load loopback, RFC1918, or cloud metadata addresses and return the contents. The practical risk is theft of cloud instance credentials and internal service data, which can turn a single poisoned web page into a cloud account compromise. Exploitation likelihood is modest today: EPSS is 0.00239 (86th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, but the attack needs only low complexity and no privileges. Inventory any agents that use SeleniumScrapingTool, upgrade to a release containing the fix from upstream PR #6870, and enforce IMDSv2 or metadata blocking and egress filtering on hosts running these agents until you have patched.

Sources:NVDEPSSATLASvulncheck.comGitHub (crewAIInc/crewAI)

What is the risk?

High (CVSS 7.4, scope changed, high confidentiality impact, no integrity or availability impact). Exploitation needs no privileges and is low complexity, but requires the agent to process attacker-influenced input, which is the user-interaction element. Likelihood is currently low to moderate: EPSS 0.00239, no KEV listing, no public exploit or scanner template. Impact rises sharply where the agent runs on cloud VMs or containers with reachable metadata endpoints and over-privileged instance roles. Package risk data is limited (no dependents or Scorecard data available), so exposure should be confirmed by internal inventory. Confidence: HIGH on the flaw (vendor-referenced code and VulnCheck advisory), MEDIUM on real-world exposure.

How does the attack unfold?

Initial Access

Attacker plants a prompt injection in web content, a document, or a message that the CrewAI agent processes.

AML.T0051.001

Tool Invocation

The agent is coerced into calling SeleniumScrapingTool with a loopback, RFC1918, or cloud metadata URL that is never validated.

AML.T0053

Credential Access

Headless Chrome fetches internal resources or the metadata service, returning IAM credentials and internal data to the agent.

AML.T0098

Impact

Stolen data leaves via the agent's output or another tool, enabling cloud account access and lateral movement.

AML.T0086

Initial Access

Attacker plants a prompt injection in web content, a document, or a message that the CrewAI agent processes.

AML.T0051.001

Tool Invocation

The agent is coerced into calling SeleniumScrapingTool with a loopback, RFC1918, or cloud metadata URL that is never validated.

AML.T0053

Credential Access

Headless Chrome fetches internal resources or the metadata service, returning IAM credentials and internal data to the agent.

AML.T0098

Impact

Stolen data leaves via the agent's output or another tool, enabling cloud account access and lateral movement.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
CrewAI	pip	—	No patch
60.1K365 dependentsPushed 8d ago17% patched~66d to patchFull package profile →

Do you use CrewAI? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade crewai-tools to a version later than 1.15.28 that includes the fix from crewAI PR #6870; verify the changelog before rollout. 2) Until patched, remove SeleniumScrapingTool from agents, or wrap it with a URL allowlist that resolves DNS and rejects loopback, RFC1918, link-local (169.254.0.0/16), and IPv6 equivalents, including after redirects. 3) Enforce IMDSv2 with hop limit 1 (or disable metadata access) and grant agent hosts least-privilege IAM roles. 4) Apply egress filtering or network segmentation so agent runtimes cannot reach internal ranges. 5) Detect: alert on agent-originated requests to 169.254.169.254, localhost, and internal ranges; review tool-call logs for unexpected URLs; monitor cloud audit logs for metadata-credential use from unusual IPs. 6) Treat web content ingested by agents as untrusted and add prompt-injection defenses and human approval for browsing tools on sensitive deployments.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt InjectionData ExtractionData LeakageAgentPluginFrameworkAML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools AML.T0086- Exfiltration via AI Agent Tool Invocation AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-112308?

crewai-tools through 1.15.28 ships a SeleniumScrapingTool that skips the validate_url private-address check, so an attacker who can steer agent tool input (for example via prompt injection in content the agent reads) can make headless Chrome load loopback, RFC1918, or cloud metadata addresses and return the contents. The practical risk is theft of cloud instance credentials and internal service data, which can turn a single poisoned web page into a cloud account compromise. Exploitation likelihood is modest today: EPSS is 0.00239 (86th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, but the attack needs only low complexity and no privileges. Inventory any agents that use SeleniumScrapingTool, upgrade to a release containing the fix from upstream PR #6870, and enforce IMDSv2 or metadata blocking and egress filtering on hosts running these agents until you have patched.

Is CVE-2026-112308 actively exploited?

No confirmed active exploitation of CVE-2026-112308 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-112308?

1) Upgrade crewai-tools to a version later than 1.15.28 that includes the fix from crewAI PR #6870; verify the changelog before rollout. 2) Until patched, remove SeleniumScrapingTool from agents, or wrap it with a URL allowlist that resolves DNS and rejects loopback, RFC1918, link-local (169.254.0.0/16), and IPv6 equivalents, including after redirects. 3) Enforce IMDSv2 with hop limit 1 (or disable metadata access) and grant agent hosts least-privilege IAM roles. 4) Apply egress filtering or network segmentation so agent runtimes cannot reach internal ranges. 5) Detect: alert on agent-originated requests to 169.254.169.254, localhost, and internal ranges; review tool-call logs for unexpected URLs; monitor cloud audit logs for metadata-credential use from unusual IPs. 6) Treat web content ingested by agents as untrusted and add prompt-injection defenses and human approval for browsing tools on sensitive deployments.

What systems are affected by CVE-2026-112308?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-agent orchestration, Tool-using LLM agents, Web browsing and scraping agents, Cloud-hosted agent runtimes.

What is the CVSS score for CVE-2026-112308?

CVE-2026-112308 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-agent orchestrationTool-using LLM agentsWeb browsing and scraping agentsCloud-hosted agent runtimes

MITRE ATLAS Techniques

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

AML.T0086Exfiltration via AI Agent Tool Invocation

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

Exploitation Scenario

An attacker plants hidden instructions on a web page, document, or support ticket that a CrewAI research agent is asked to process. The injected text tells the agent to call SeleniumScrapingTool on http://169.254.169.254/latest/meta-data/iam/security-credentials/ followed by the role name. Headless Chrome fetches the metadata response because no private-address check is applied, and the credentials enter the agent's context. The injection then instructs the agent to include the output in a summary, a markdown image URL, or an outbound tool call to an attacker-controlled endpoint. The attacker uses the stolen temporary cloud credentials to access storage, secrets, or model endpoints.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.