Is crewai-tools patched against CVE-2026-112308?

VulnCheck lists no fixed version for CVE-2026-112308. The pull request that adds the private-address check to SeleniumScrapingTool, crewAI 6870, was opened on August 8, 2026 and closed on September 17, 2026 without being merged, after a bot flagged that first-time contributor pull requests must reference an open issue. The tool's current source on main still carries only a scheme check.

Which crewAI deployments are exposed to this SSRF?

Crews that register SeleniumScrapingTool from crewai-tools are exposed, and VulnCheck's advisory lists releases up to and including 1.15.28. Crews built only from the package's other scraping tools, such as the Firecrawl and Scrapfly tools, call validate_url instead. Checking which tools a crew registers is the fastest way to tell whether the flaw applies.

What can an attacker read through this crewai-tools flaw?

VulnCheck says a successful request can expose internal data and cloud credentials, because headless Chrome will fetch loopback, RFC1918 and cloud metadata addresses. The advisory scores the flaw 8.3 on CVSS v4.0, with high confidentiality impact on both the vulnerable system and subsequent systems, and no integrity or availability impact.

MEDVulnerability

crewai-tools: a scraping tool skips the SSRF check on agent URLs

SeleniumScrapingTool hands an agent-supplied URL to headless Chrome without the private-address check its sibling tools apply.

October 19, 2026 · VulnCheck · Research by SashaMIT, Zachariah Mithani

CVE-2026-112308

Advisory card reading crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

MEDVulnerability

CVE-2026-112308 is a server-side request forgery flaw in the SeleniumScrapingTool of crewai-tools, which skips the private-address check the package applies in its other scraping tools. VulnCheck lists no fixed version.

01What happened

VulnCheck published CVE-2026-112308 on October 19, 2026, crediting SashaMIT and Zachariah Mithani. The advisory covers crewai-tools through version 1.15.28, the tool library for the crewAI agent framework. GitHub's advisory database carries the same report as GHSA-5595-9g9c-5cc4.

02How it works

SeleniumScrapingTool never calls validate_url, the helper that the Firecrawl and Scrapfly tools in the same package use to block private addresses. An attacker who gets instructions into the agent's tool input can therefore set website_url to a loopback, RFC1918 or cloud metadata address, and the headless Chrome browser fetches it. VulnCheck says the result can expose internal data and cloud credentials.

03Who is affected

Crews that register SeleniumScrapingTool are the exposed configuration, and VulnCheck lists crewai-tools releases up to and including 1.15.28. The tool's source on the project's main branch checks only that the URL starts with http or https and contains no whitespace, with no host resolution.

04What to do

Remove SeleniumScrapingTool from crews that scrape pages an attacker can influence, or put it behind a tool that resolves the host and rejects loopback, link-local and private ranges. Block the agent host's access to cloud metadata endpoints at the network layer.

Questions people ask

Is crewai-tools patched against CVE-2026-112308?: VulnCheck lists no fixed version for CVE-2026-112308. The pull request that adds the private-address check to SeleniumScrapingTool, crewAI 6870, was opened on August 8, 2026 and closed on September 17, 2026 without being merged, after a bot flagged that first-time contributor pull requests must reference an open issue. The tool's current source on main still carries only a scheme check.
Which crewAI deployments are exposed to this SSRF?: Crews that register SeleniumScrapingTool from crewai-tools are exposed, and VulnCheck's advisory lists releases up to and including 1.15.28. Crews built only from the package's other scraping tools, such as the Firecrawl and Scrapfly tools, call validate_url instead. Checking which tools a crew registers is the fastest way to tell whether the flaw applies.
What can an attacker read through this crewai-tools flaw?: VulnCheck says a successful request can expose internal data and cloud credentials, because headless Chrome will fetch loopback, RFC1918 and cloud metadata addresses. The advisory scores the flaw 8.3 on CVSS v4.0, with high confidentiality impact on both the vulnerable system and subsequent systems, and no integrity or availability impact.

Sources 4 links, all fetched

1vulncheck.comVulnCheck Advisory
2github.comGitHub Advisory
3github.comClosed Fix PR
4github.comTool Source