CVE-2026-37009: SQLi in NL2SQLTool

CISO Take

A SQL injection flaw in crewai-tools' NL2SQLTool lets an attacker who controls the sql_query argument execute arbitrary SQL against whatever database the agent is wired to, turning a natural-language-to-SQL convenience feature into a direct database attack surface. There's no CVSS score, EPSS data, or CISA KEV listing yet — this was published less than a day ago and affects a release-candidate build (v1.10.2rc1), so exploitation telemetry simply doesn't exist yet, but crewai is a widely-deployed agentic framework and NL2SQLTool is exactly the kind of tool agents invoke autonomously from user or document-sourced input, which raises the risk that the injection point is reachable indirectly, not just via a direct API call. No public exploit or Nuclei template exists today, so this isn't a scan-and-pwn target yet, but classic SQL injection is trivial to weaponize once someone writes a PoC. Security teams running crewai agents with database-connected tools should avoid 1.10.2rc1, watch for a patched release, and in the meantime treat sql_query as untrusted input requiring parameterized queries and a least-privilege DB account regardless of what the framework does internally.

Sources: NVD ATLAS crewaiinc.com

What is the risk?

Currently low-to-medium confirmed risk due to the absence of CVSS scoring, EPSS data, KEV listing, and public exploit code, combined with the fact that the affected version is a release candidate (1.10.2rc1) with limited real-world adoption. However, the underlying vulnerability class — unsanitized input reaching raw SQL execution — is structurally severe (typically critical once scored) and sits inside an AI agent tool that may receive its input indirectly through LLM-generated or prompt-influenced content rather than only through a trusted API caller, which is a meaningfully worse exposure profile than a traditional web app SQLi.

How does the attack unfold?

Initial access

Attacker identifies or gains access to an application where a crewai agent exposes NL2SQLTool, either via a direct user-facing interface or content the agent later ingests.

AML.T0084.001

Exploitation

Attacker supplies or induces a sql_query value containing SQL injection syntax, which the tool passes unsanitized to the underlying database.

AML.T0053

Impact

Injected SQL executes with the agent's database privileges, enabling data exfiltration, unauthorized modification, or destruction of records.

AML.T0086

Initial access

Attacker identifies or gains access to an application where a crewai agent exposes NL2SQLTool, either via a direct user-facing interface or content the agent later ingests.

AML.T0084.001

Exploitation

Attacker supplies or induces a sql_query value containing SQL injection syntax, which the tool passes unsanitized to the underlying database.

AML.T0053

Impact

Injected SQL executes with the agent's database privileges, enabling data exfiltration, unauthorized modification, or destruction of records.

AML.T0086

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Avoid deploying v1.10.2rc1 of crewai-tools with NL2SQLTool against production or sensitive databases until an official fix ships; monitor the crewai-tools changelog/GitHub Advisory for a patched release. In the interim, don't trust the library's internal handling — wrap any NL2SQLTool database connection behind a read-only, least-privilege DB account, enforce parameterized queries or a query allowlist at the connection layer, and add DB-side logging/anomaly detection for unexpected UNION/stacked-query patterns. If the tool is exposed to end users or to content the agent reads (documents, emails, web pages), treat it as an untrusted-input surface and apply the same input validation discipline as a public-facing SQL API.

How is it classified?

Code Execution Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-37009?

A SQL injection flaw in crewai-tools' NL2SQLTool lets an attacker who controls the sql_query argument execute arbitrary SQL against whatever database the agent is wired to, turning a natural-language-to-SQL convenience feature into a direct database attack surface. There's no CVSS score, EPSS data, or CISA KEV listing yet — this was published less than a day ago and affects a release-candidate build (v1.10.2rc1), so exploitation telemetry simply doesn't exist yet, but crewai is a widely-deployed agentic framework and NL2SQLTool is exactly the kind of tool agents invoke autonomously from user or document-sourced input, which raises the risk that the injection point is reachable indirectly, not just via a direct API call. No public exploit or Nuclei template exists today, so this isn't a scan-and-pwn target yet, but classic SQL injection is trivial to weaponize once someone writes a PoC. Security teams running crewai agents with database-connected tools should avoid 1.10.2rc1, watch for a patched release, and in the meantime treat sql_query as untrusted input requiring parameterized queries and a least-privilege DB account regardless of what the framework does internally.

Is CVE-2026-37009 actively exploited?

No confirmed active exploitation of CVE-2026-37009 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-37009?

Avoid deploying v1.10.2rc1 of crewai-tools with NL2SQLTool against production or sensitive databases until an official fix ships; monitor the crewai-tools changelog/GitHub Advisory for a patched release. In the interim, don't trust the library's internal handling — wrap any NL2SQLTool database connection behind a read-only, least-privilege DB account, enforce parameterized queries or a query allowlist at the connection layer, and add DB-side logging/anomaly detection for unexpected UNION/stacked-query patterns. If the tool is exposed to end users or to content the agent reads (documents, emails, web pages), treat it as an untrusted-input surface and apply the same input validation discipline as a public-facing SQL API.

What systems are affected by CVE-2026-37009?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, database-connected AI agents, data analytics pipelines.

What is the CVSS score for CVE-2026-37009?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksdatabase-connected AI agentsdata analytics pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.

Exploitation Scenario

An attacker interacts with an application built on crewai that gives an agent access to NL2SQLTool — either directly through a chat/API interface or indirectly by planting malicious instructions in a document, email, or web page the agent later processes. The attacker crafts a request that causes the sql_query argument to contain injection syntax (e.g., a UNION SELECT to dump unrelated tables, or a stacked query to modify data). Because the argument is passed unsanitized to the database, the injected SQL executes with whatever privileges the agent's DB connection holds, letting the attacker exfiltrate sensitive records, escalate within the database, or destroy data — all without ever touching the database directly.