CVE-2026-112308

7.4High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality
Weakness: CWE-918

Impact

Attackers can reach loopback, RFC1918 networks, and cloud metadata services to steal credentials and sensitive data. Exploitation requires feeding untrusted input to the agent to trigger prompt injection into tool arguments.

Root cause

SeleniumScrapingTool fails to call the validate_url function to block private IP addresses before sending URLs to headless Chrome.

Affected systems

crewai-tools through 1.15.28

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Fix & remediation

Upgrade crewai-tools past 1.15.28 once a patched release is published. As an immediate workaround, disable SeleniumScrapingTool or block access to the cloud metadata endpoint (169.254.169.254) and internal networks via host firewall rules or network policies.

shell

$ pip install --upgrade crewai-tools

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112308