CVE-2026-112308

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

8.3 High

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.24%Unchanged since Oct 20, 2026

What each source reports

CVE List Score used 8.3

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

Record: CVE-2026-112308
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-104400 8.3

Record: EUVD-2026-104400
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5595-9g9c-5cc4 8.3

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in...

Record: GHSA-5595-9g9c-5cc4
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 8.3

Record: CVE-2026-112308
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 8.3

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

Record: CVE-2026-112308
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-02

Affected products

crewaiinc crewai-tools

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112308 is a high vulnerability (CVSS 8.3) in Crewaiinc Crewai-tools, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.