CVE-2026-112308: crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using crewai-tools through 1.15.28 that make SeleniumScrapingTool available to agents are exposed, particularly where an attacker can influence tool input through prompt injection. The affected tool can cause headless Chrome to request loopback, RFC1918, and cloud metadata addresses.
What does an attacker need to exploit it?
An attacker needs a way to influence an agent's SeleniumScrapingTool input, such as prompt injection. No authenticated application privileges are indicated, but exploitation requires user interaction according to the supplied vector.
What information could be exposed?
The tool may retrieve internal resources and disclose their contents. This includes cloud metadata responses and potentially cloud credentials.
How can I determine whether my environment is affected?
Check whether crewai-tools is installed at version 1.15.28 or earlier and whether SeleniumScrapingTool is enabled or reachable by agents. Review whether untrusted prompts or content can influence URLs passed to that tool.
What can be done if updating is not immediately possible?
Prevent untrusted agent input from controlling SeleniumScrapingTool URLs, and restrict the headless browser's network access to loopback, RFC1918, cloud metadata, and other internal services. The vulnerability exists because the tool does not apply the validate_url private-address check.