Cpe:2.3:a:crewai:crewai-Tools:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acrewaicrewai-tools/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 18:08:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSSRF Vulnerability in CrewAI SeleniumScrapingTool (CVE-2026-112308)https://feed.craftedsignal.io/briefs/2026-10-crewai-ssrf/Mon, 19 Oct 2026 18:08:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-crewai-ssrf/An SSRF vulnerability in the SeleniumScrapingTool component of crewai-tools allows attackers to exfiltrate internal resources or cloud credentials via malicious prompt injection.CrewAI crewai-tools versions 1.15.28 and earlier are affected by a server-side request forgery (SSRF) vulnerability located in the SeleniumScrapingTool component. The tool fails to implement necessary URL validation via the validate_url function, leaving the service open to requests targeting internal infrastructure. An attacker can exploit this via prompt injection by providing a crafted URL to an AI agent that utilizes the SeleniumScrapingTool. This enables the headless Chrome instance controlled by the tool to perform requests against the local loopback interface, private RFC1918 network segments, or cloud metadata endpoints. Successful exploitation allows for the unauthorized disclosure of internal data, configuration files, or cloud environment credentials, significantly impacting the confidentiality of the target environment.

Impact

The vulnerability affects organizations deploying crewai-tools within their production environments, particularly those integrated with cloud services where metadata endpoints (e.g., 169.254.169.254) are accessible. Unauthorized access to these endpoints can lead to the full compromise of identity and access management (IAM) credentials associated with the hosting instance or container, potentially escalating access to broader cloud infrastructure.

Recommendation

  • Update crewai-tools to version 1.15.29 or later immediately to incorporate the missing URL validation logic.
  • Implement network egress filtering on instances running AI agent tools to block requests to non-routable internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata services (169.254.169.254).
  • Restrict the permissions of the IAM roles assigned to machines running these tools to follow the principle of least privilege, preventing unauthorized access to sensitive data even if a credential exfiltration attempt occurs.
  • Audit logs for the headless browser process execution to identify anomalous request patterns directed at internal resources.
]]>highadvisoryssrfprompt-injectioncloud-security