crewai-tools SSRF vulnerability in SeleniumScrapingTool exposes internal resources via prompt injection

The crewai-tools library contains a high-severity vulnerability that exposes internal network resources to unauthorized access. According to the National Vulnerability Database record for CVE-2026-112308, the issue resides in the SeleniumScrapingTool component. This flaw allows attackers to fetch internal resources because the tool fails to apply private-address validation checks. The vulnerability is rated 8.3 on the CVSS scale, placing it in the high severity category.

The risk

The core of this vulnerability is a server-side request forgery weakness, classified under CWE-918. The SeleniumScrapingTool does not verify whether requested URLs point to private or restricted network ranges. An attacker who can influence the input provided to an agent through prompt injection can exploit this gap. By manipulating the tool’s input, the attacker directs the headless Chrome browser to specific internal targets. This includes loopback addresses, RFC1918 private network ranges, and cloud metadata endpoints.

Who is exposed

Any environment using crewai-tools version 1.15.28 or earlier is potentially affected by this flaw. The vulnerability specifically impacts systems where the SeleniumScrapingTool is active and accessible. Organizations relying on this library for web scraping or data extraction tasks within their AI agent workflows face the highest risk. If an attacker can inject prompts into the agent, they can leverage the tool to probe the internal network. This exposure allows for the disclosure of sensitive internal data and cloud credentials.

Cost and compliance

The source material does not provide specific financial impact figures or compliance implications for this vulnerability. The National Vulnerability Database record focuses solely on the technical description and severity rating. There is no mention of regulatory penalties or direct monetary costs associated with the exploitation of CVE-2026-112308 in the provided records. Organizations must assess their own risk tolerance regarding internal data exposure and credential leakage.

What to watch

Security teams should monitor for unusual outbound traffic from agents using the SeleniumScrapingTool. Look for connections to internal IP ranges or cloud metadata services that were not authorized. Review agent logs for prompt injection attempts that result in unexpected URL requests. These behaviors may indicate an attempt to exploit the missing private-address validation check.

Signals worth monitoring

Teams usually detect this activity by reviewing web proxy logs for requests originating from application servers to internal ranges. Check whether headless browser processes are accessing loopback or RFC1918 addresses unexpectedly. Monitor for spikes in DNS queries for internal hostnames from agent workloads. Look for authentication failures on internal services that should not receive external traffic.

Investigate any new connections to cloud metadata endpoints from application containers. Verify that network segmentation prevents direct access from agent environments to sensitive internal hosts. Review application logs for unusual URL patterns passed to scraping tools. Check for evidence of prompt injection in user-facing interfaces that drive agent behavior.

What to do and how to stay safe: crewai-tools

• Audit your crewai-tools version and check if it is 1.15.28 or older.
• Review network logs for connections from agent environments to internal IP ranges.
• Implement strict input validation for any prompts that influence agent tool usage.
• Restrict network access from agent workloads to prevent direct internal probing.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The CVE ID for this server-side request forgery flaw is CVE-2026-112308.

Which versions of crewai-tools are affected?

Versions up to and including 1.15.28 are affected by this vulnerability.

How can an attacker exploit this flaw?

Attackers can use prompt injection to direct the SeleniumScrapingTool to internal addresses.