Is CVE-2026-112308 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112308 being exploited in the wild.

How severe is CVE-2026-112308?

High severity, with a CVSS score of 7.4, published 19 October 2026.

How is CVE-2026-112308 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112308?

Check whether you run Crewai-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112308: crewai-tools SeleniumScrapingTool server-side request forgery

CVE-2026-112308 · Severity: high · CVSS 7.4 · Published 2026-10-19

crewai-tools is a library that provides web scraping capabilities for AI agents. A flaw in the SeleniumScrapingTool allows attackers to exploit prompt injection to direct the tool to fetch internal network resources, such as cloud metadata services or private databases, exposing sensitive data including cloud credentials.

Vendors: crewAI.

Quick answers

Is CVE-2026-112308 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112308 being exploited in the wild.
How severe is CVE-2026-112308?: High severity, with a CVSS score of 7.4, published 19 October 2026.
Which products and versions are affected?: Crewai-Tools through 1.15.28.
Is there a fix for CVE-2026-112308?: Yes: fixed in crewai-tools versions after 1.15.28 (exact version not specified in advisory). Until then: Route all SeleniumScrapingTool URL inputs through the validate_url helper function to block private and reserved address ranges before passing them to the Chrome WebDriver, implementing the same validation pattern used by other scraping tools in the library. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112308 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112308?: Check whether you run Crewai-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: crewai-tools versions after 1.15.28 (exact version not specified in advisory)

Route all SeleniumScrapingTool URL inputs through the validate_url helper function to block private and reserved address ranges before passing them to the Chrome WebDriver, implementing the same validation pattern used by other scraping tools in the library.

Technical details

The SeleniumScrapingTool fails to validate URLs before passing them to a headless Chrome WebDriver, allowing access to private address ranges (loopback, RFC1918, link-local) and cloud metadata endpoints (169.254.169.254). An attacker who can influence agent tool input through prompt injection can direct the tool to these internal resources, resulting in disclosure of internal data and cloud credentials. The vulnerability exists because the tool does not apply the validate_url private-address check that sibling scraping tools already use.

Affected products

crewAI crewai-tools through 1.15.28

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.