Key points
- The vulnerability is tracked as CVE-2026-112308 with a CVSS score of 8.3.
- Affected versions of crewai-tools include all releases through 1.15.28.
- Attackers can exploit the flaw via prompt injection to target internal addresses.
The crewai-tools library, specifically versions up to 1.15.28, contains a high-severity security flaw. The National Vulnerability Database assigned the identifier CVE-2026-112308 to this issue. The flaw exists within the SeleniumScrapingTool component. It is classified as a server-side request forgery vulnerability. The Common Vulnerability Scoring System rate is 8.3, which falls into the high category. This rating reflects the potential for attackers to access sensitive internal data.
In plain English
The SeleniumScrapingTool is designed to browse the web using a headless Chrome browser. However, it fails to check if a requested URL points to private addresses. This means the tool will visit any link it is given, even those on your local network. An attacker does not need to break into your server directly. They only need to influence the input that the tool processes.
The background
According to the NVD record, the weakness is categorized under CWE-918. The specific failure is that the tool never applies a private-address check to validate URLs. This oversight allows the tool to be directed toward loopback addresses. It can also be pointed at RFC1918 private networks. Additionally, attackers can send requests to cloud metadata endpoints. These endpoints often hold sensitive credentials and configuration data.
What changes now
Attackers can exploit this by using prompt injection techniques. They trick the AI agent into passing malicious URLs to the scraping tool. Once the tool visits these internal addresses, it can fetch resources it should not see. This could lead to the disclosure of internal data. It may also expose cloud credentials stored on metadata servers. The risk is present in all versions of crewai-tools up to 1.15.28.
Who needs to act first
Teams should prioritize updating systems that expose this tool to untrusted input. Check whether your agents process data from external users or third-party APIs. Roll out any available updates to these exposed systems first. Test changes in a non-production environment before applying them broadly. Ensure you have recent backups of your configurations. If no update is ready, consider restricting network access for the tool. Monitor logs for unusual outbound connections to internal IP ranges.
What to do and how to stay safe: crewai-tools
- Identify which agents use the SeleniumScrapingTool and assess their exposure to external input.
- Restrict network permissions for the headless Chrome process to prevent access to internal ranges.
- Monitor outbound traffic from the tool for requests to localhost or private IP subnets.
- Review agent prompts for signs of injection attempts that might redirect the scraper.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2026-112308.
Which versions of crewai-tools are affected?
All versions of crewai-tools through 1.15.28 are affected by this flaw.
How can an attacker exploit this issue?
Attackers can use prompt injection to direct the tool to internal or cloud metadata addresses.
