CrewAI Critical Vulnerabilities (CVE-2026-2275 et al.)
Date: 2026-03
Affected: CrewAI Critical Vulnerabilities (CVE-2026-2275 et al.)
Attack vector: ssrf
Category: real-world
Severity: Critical
CVE: CVE-2026-2275
CVE-2026-2285
CVE-2026-2286
CVE-2026-2287
CWE: CWE-749
CWE-918
CWE-94
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

Four CVEs: sandbox escape via CodeInterpreter Docker fallback, SSRF in RAG search tools, arbitrary local file read in JSON loader. Chained via prompt injection to escape sandbox and execute code on host. Separately, a leaked internal GitHub token (CVSS 9.2) granted full access to CrewAI's private repos. No complete patch available.


Mitigations:

Architectural layers (MAESTRO):