{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/crewai/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crewai:crewai-tools:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-112308"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["crewai-tools (\u003c= 1.15.28)"],"_cs_severities":["high"],"_cs_tags":["ssrf","prompt-injection","cloud-security"],"_cs_type":"advisory","_cs_vendors":["CrewAI"],"content_html":"\u003cp\u003eCrewAI crewai-tools versions 1.15.28 and earlier are affected by a server-side request forgery (SSRF) vulnerability located in the SeleniumScrapingTool component. The tool fails to implement necessary URL validation via the validate_url function, leaving the service open to requests targeting internal infrastructure. An attacker can exploit this via prompt injection by providing a crafted URL to an AI agent that utilizes the SeleniumScrapingTool. This enables the headless Chrome instance controlled by the tool to perform requests against the local loopback interface, private RFC1918 network segments, or cloud metadata endpoints. Successful exploitation allows for the unauthorized disclosure of internal data, configuration files, or cloud environment credentials, significantly impacting the confidentiality of the target environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects organizations deploying crewai-tools within their production environments, particularly those integrated with cloud services where metadata endpoints (e.g., 169.254.169.254) are accessible. Unauthorized access to these endpoints can lead to the full compromise of identity and access management (IAM) credentials associated with the hosting instance or container, potentially escalating access to broader cloud infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate crewai-tools to version 1.15.29 or later immediately to incorporate the missing URL validation logic.\u003c/li\u003e\n\u003cli\u003eImplement network egress filtering on instances running AI agent tools to block requests to non-routable internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata services (169.254.169.254).\u003c/li\u003e\n\u003cli\u003eRestrict the permissions of the IAM roles assigned to machines running these tools to follow the principle of least privilege, preventing unauthorized access to sensitive data even if a credential exfiltration attempt occurs.\u003c/li\u003e\n\u003cli\u003eAudit logs for the headless browser process execution to identify anomalous request patterns directed at internal resources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:08:43Z","date_published":"2026-10-19T18:08:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-crewai-ssrf/","summary":"An SSRF vulnerability in the SeleniumScrapingTool component of crewai-tools allows attackers to exfiltrate internal resources or cloud credentials via malicious prompt injection.","title":"SSRF Vulnerability in CrewAI SeleniumScrapingTool (CVE-2026-112308)","url":"https://feed.craftedsignal.io/briefs/2026-10-crewai-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - CrewAI","version":"https://jsonfeed.org/version/1.1"}