EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in CrewAI, a framework used to build and orchestrate autonomous AI agents. Affected versions include all currently available versions of CrewAI. The vulnerabilities, which include Remote Code Execution, Server-Side Request Forgery, and sandbox escapes, could allow an attacker to completely bypass sandboxes and compromise host systems. This poses a significant business risk, as it could result in the theft of sensitive information, disruption of critical operations, and reputational damage. The vulnerabilities highlight the importance of robust security measures in AI systems and the need for vendors to prioritize security in their development processes.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in CrewAI, a framework used to build and orchestrate autonomous AI agents. Affected versions include all currently available versions of CrewAI. The vulnerabilities, which include Remote Code Execution, Server-Side Request Forgery, and sandbox escapes, could allow an attacker to completely bypass sandboxes and compromise host systems. This poses a significant business risk, as it could result in the theft of sensitive information, disruption of critical operations, and reputational damage. The vulnerabilities highlight the importance of robust security measures in AI systems and the need for vendors to prioritize security in their development processes.[emaillocker id="1283"]
CVE-2026-2275 with a CVSS score of 9.8 – A failure in environment validation allows for arbitrary C function calls, enabling code execution through insecure fallback behaviors.
CVE-2026-2287 with a CVSS score of 9.8 – The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, creating a dangerous opening for RCE exploitation.
CVE-2026-2286 with a CVSS score of 9.0 – SSRF flaw allows for content acquisition from internal and cloud services due to a failure to validate URLs provided at runtime.
CVE-2026-2285 with a CVSS score of 8.3 – Local File Read flaw enables access to files on the server due to improper path validation in the JSON loader tool.
The vulnerability poses a critical risk to organizations using CrewAI, with potential consequences including credential theft, full RCE if the host machine is in configuration mode or unsafe mode, and reputational damage.
RECOMMENDATION:
We recommend you to update CrewAI to the below version link: https://www.kb.cert.org/vuls/id/221883
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/crewai-vulnerabilities-rce-ssrf-sandbox-escap e-cve-2026/