{"id":"CVE-2026-112308","title":"crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool","summary":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influe…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"crewAIInc","product":"crewai-tools","affected":["crewai-tools <= 1.15.28"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T18:23:18.177311Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:23:27.612Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112308","references":[{"url":"https://github.com/crewAIInc/crewAI/pull/6870"},{"url":"https://github.com/crewAIInc/crewAI/blob/1.15.28/lib/crewai-tools/src/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py"},{"url":"https://www.vulncheck.com/advisories/crewai-tools-through-1.15.28-ssrf-via-seleniumscrapingtool","label":"VulnCheck Advisory: crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T16:32:30.080Z","slug":"CVE-2026-112308","body":"## Overview\n\ncrewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.\n\n## Affected\n\n- `crewai-tools <= 1.15.28`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}