CrewAI Hit by Critical Vulnerabilities Enabling Sandbox Escape and Host Compromise

CrewAI, a prominent tool used by developers to orchestrate multi-agent AI systems, is currently vulnerable to a chain of critical security flaws.

By using direct or indirect prompt injection, attackers can manipulate AI agents to escape secure sandboxes and compromise the host machine.

The primary threat stems from insecure fallback behaviors and configuration settings within the CrewAI agent and its Docker environments.

The most severe flaw originates in the framework’s Code Interpreter Tool, which is designed to safely execute Python code. When attackers exploit this tool, they can trigger the remaining vulnerabilities to steal credentials or gain deeper network access.

Security researcher Yarden Porat from Cyata recently discovered four vulnerabilities that expose the framework to remote code execution (RCE), server-side request forgery (SSRF), and arbitrary local file reads.

Identified CVEs

• CVE-2026-2275: The Code Interpreter Tool automatically falls back to a vulnerable SandboxPython environment if it cannot reach Docker, allowing attackers to execute arbitrary C function calls.
• CVE-2026-2286: An SSRF vulnerability exists in the RAG search tools because they fail to properly validate runtime URLs, allowing unauthorized access to internal and cloud services.
• CVE-2026-2287: CrewAI fails to continuously verify that Docker is running during execution, causing the system to default to an insecure sandbox mode that permits RCE.
• CVE-2026-2285: A local file read vulnerability in the JSON loader tool lacks file path validation, enabling threat actors to access sensitive files directly from the server.

Exploitation heavily relies on the Code Interpreter Tool being active. If an attacker successfully compromises an agent, the impact varies based on the host setup.

If the host machine uses Docker, the attacker can achieve a sandbox bypass. If the machine operates in configuration or unsafe modes, the attacker can achieve full remote code execution to take over the device completely.

Currently, there is no complete patch available for all four vulnerabilities.

The vendor has acknowledged the issues and plans to release updates that block unsafe modules like ctypes and force the system to fail securely rather than falling back to an open sandbox.

Until an official update is deployed, administrators must take immediate defensive action. Users should completely disable the Code Interpreter Tool and ensure the allow_code_execution=True setting is turned off unless absolutely necessary.

Security teams must also sanitize all untrusted agent inputs and strictly monitor Docker availability to prevent the system from triggering the vulnerable fallback modes.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.