{"id":"CVE-2026-112308","kind":"vulnerability","aliases":["CVE-2026-112308"],"related":[],"title":"crewai-tools: SeleniumScrapingTool lets prompt injection reach internal addresses","description":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.","summary":"crewai-tools through 1.15.28 has an SSRF in SeleniumScrapingTool because it skips the validate_url private-address check. An attacker who injects prompts into an agent can make headless Chrome fetch loopback, internal, or cloud metadata addresses and read internal data and cloud credentials.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","cloud","crewai","python"],"not_affected_if":["no-untrusted-input","tool-not-used","upgraded"],"how_to_check":"- Run `pip show crewai-tools` and compare the version against `1.15.28`\n- Search the project for `SeleniumScrapingTool` to see whether agents use it","fix":"- Upgrade `crewai-tools` to a version later than `1.15.28` (the fixed version is unknown from the sources)\n- Until patched, remove SeleniumScrapingTool from agents that process untrusted input","status":"open","published_at":"2026-10-19T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:02:27+00:00","updated_at":"2026-10-25T03:02:27+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:02:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `crewai-tools` to a version later than `1.15.28` (the fixed version is unknown from the sources)\n- Until patched, remove SeleniumScrapingTool from agents that process untrusted input","reach":"internet","title":"crewai-tools: SeleniumScrapingTool lets prompt injection reach internal addresses","impact":"high","summary":"crewai-tools through 1.15.28 has an SSRF in SeleniumScrapingTool because it skips the validate_url private-address check. An attacker who injects prompts into an agent can make headless Chrome fetch loopback, internal, or cloud metadata addresses and read internal data and cloud credentials.","category":"ai-tooling","nicknames":[],"who_cares":["python","crewai","ai-agents","cloud"],"confidence":0.7,"needs_auth":"no","worst_case":"internal data and cloud credentials are read via the agent's browser","analyst_note":"Confirm the fixed version of crewai-tools and whether a patch or advisory exists on NVD or the CrewAI repository.","how_to_check":"- Run `pip show crewai-tools` and compare the version against `1.15.28`\n- Search the project for `SeleniumScrapingTool` to see whether agents use it","needs_analyst":true,"not_affected_if":["tool-not-used","no-untrusted-input","upgraded"],"who_is_affected":"Teams running crewai-tools up to and including 1.15.28 with SeleniumScrapingTool in an agent that reads web or user-supplied input. Agents without this tool, or without untrusted input reaching it, are less exposed. Hosts with cloud metadata endpoints or internal services reachable from the agent's network raise the stakes.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3355,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112308':13A,16A '-2026':12A,15A '1.15.28':30B,76C 'address':10A,44B,64B,103C,123C 'agent':19B,53B,107C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'allow':88C 'appli':97C 'attack':47B,89C,105C 'check':45B,104C 'chrome':57B,116C 'cloud':23B,62B,70B,121C,129C 'contain':77C 'credenti':71B,130C 'crewai':2A,24B,27B,73C 'crewai-tool':1A,26B,72C 'cve':11A,14A 'data':68B,127C 'direct':114C 'disclos':125C 'fetch':58B,91C 'forgeri':83C 'headless':56B,115C 'influenc':106C 'inject':7A,49B,112C 'input':109C 'intern':9A,60B,67B,92C,126C 'let':5A 'loopback':59B,118C 'make':55B 'metadata':63B,122C 'never':96C 'privat':43B,102C 'private-address':42B,101C 'prompt':6A,50B,111C 'python':25B 'reach':8A 'read':66B 'request':82C 'resourc':93C 'rfc1918':119C 'seleniumscrapingtool':4A,35B,86C 'server':80C 'server-sid':79C 'side':81C 'skip':38B 'ssrf':33B 'tool':3A,22B,28B,74C,108C 'url':41B,100C 'valid':40B,99C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams running crewai-tools up to and including 1.15.28 with SeleniumScrapingTool in an agent that reads web or user-supplied input. Agents without this tool, or without untrusted input reaching it, are less exposed. Hosts with cloud metadata endpoints or internal services reachable from the agent's network raise the stakes.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112308","severity":null,"published_at":"2026-10-19T16:17:06+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}