Live › vulnerability › CVE-2026-112308
Go to dashboardcrewai-tools through 1.15.28 has an SSRF in SeleniumScrapingTool because it skips the validate_url private-address check. An attacker who injects prompts into an agent can make headless Chrome fetch loopback, internal, or cloud metadata addresses and read internal data and cloud credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running crewai-tools up to and including 1.15.28 with SeleniumScrapingTool in an agent that reads web or user-supplied input. Agents without this tool, or without untrusted input reaching it, are less exposed. Hosts with cloud metadata endpoints or internal services reachable from the agent's network raise the stakes.
No product ranges from the sources yet.
pip show crewai-tools and compare the version against 1.15.28SeleniumScrapingTool to see whether agents use itcrewai-tools to a version later than 1.15.28 (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-112308")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.