Prompt injection turns crewAI scraping tool into an SSRF gateway

A server-side request forgery flaw in crewAI's agent tooling library lets attackers use prompt injection to make an agent fetch internal network resources and cloud credentials, according to an entry published to the US National Vulnerability Database on 19 October 2026.

The issue is tracked as CVE-2026-112308 and affects crewai-tools through version 1.15.28. According to the NVD record, the problem sits in SeleniumScrapingTool, a component that drives a headless Chrome browser so that an agent can load and read web pages. The tool "never applies the validate_url private-address check", the record says, meaning the address an agent is told to visit is not screened to see whether it points inside the network rather than out to the public internet.

That missing check matters because of how agents take instructions. The NVD entry states that attackers who can influence agent tool input through prompt injection — hostile text placed where a model will read it and treat it as an instruction — can direct the headless browser to loopback addresses, RFC1918 private ranges, or cloud metadata addresses. The consequence, according to the record, is disclosure of internal data and cloud credentials.

Cloud metadata endpoints are the detail that turns a browsing bug into a credentials problem. They are internal-only addresses that return configuration and, on many platforms, short-lived access tokens for the machine making the request. A component that will fetch any URL it is handed, from inside the network, is exactly the kind of thing that can be pointed at them. In this case the fetching is done by a browser the agent controls, so the attacker does not need any direct network access of their own — only the ability to get text in front of the agent.

The advisory records the root cause as prompt injection combined with the absent URL validation. The two are related but separate: the injection decides where the agent is told to go, while the lack of address filtering is what allows the request to succeed. Code that applies validation to some fetching paths but not others is a recurring pattern in agent tool libraries, where several tools often sit side by side and only some inherit the safety checks.

The NVD entry links to three references: the source file for SeleniumScrapingTool as it stands at the 1.15.28 tag in the crewAI repository, a pull request in that repository numbered 6870, and an advisory published by VulnCheck describing the same issue.

The listed sources do not state when the flaw was first reported privately, whether it has been exploited, or which released version, if any, contains a fix. Operators running crewai-tools at or below 1.15.28 should check the referenced pull request and advisory for the current remediation position.