source code free stock image for MCPwatch editorial use

Four CrewAI CVEs Chain Prompt Injection to Host RCE and SSRF (VU#221883)

by
source code free stock image for MCPwatch editorial use
Topic image: source code free stock image for MCPwatch editorial use.

What Happened

On March 30, 2026, CERT/CC published VU#221883, disclosing four vulnerabilities in the CrewAI multi-agent framework. The cluster was reported by security researcher Yarden Porat of Cyata and spans remote code execution, arbitrary file read, and server-side request forgery — all reachable through prompt injection against an agent that has access to the affected tools.

The four CVEs:

  • CVE-2026-2275 (CVSS 9.6 Critical) — The CodeInterpreter tool silently falls back from Docker to SandboxPython when Docker is unreachable. Attackers can then call arbitrary C functions via ctypes, achieving host-level RCE.
  • CVE-2026-2287 (CVSS 9.8 Critical) — CrewAI does not continuously verify Docker availability during execution. If Docker goes offline mid-session, the system reverts to the insecure sandbox, exposing the same RCE path.
  • CVE-2026-2285 (CVSS 7.5 High) — Arbitrary local file read via a tool accessible to agents, allowing an attacker who has achieved prompt injection to exfiltrate host files such as /etc/shadow, environment variables, or adjacent workloads’ configurations.
  • CVE-2026-2286 (CVSS 9.8 Critical) — SSRF in RAG search tools reachable through agent prompts, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and credential stores.

The vulnerabilities chain together: prompt injection → sandbox escape (CVE-2026-2275/2287) → host RCE → file read (CVE-2026-2285) or cloud metadata SSRF (CVE-2026-2286). A single crafted prompt can compromise the host.

Why It Matters for MCP and Agent-Tool Endpoints

CrewAI is one of the most widely deployed multi-agent orchestration frameworks. The same design pattern — an AI agent receiving untrusted input and autonomously invoking tools on a host — is shared across the Model Context Protocol (MCP) ecosystem. Key implications:

  • Silent fallback is a systemic risk. When a sandbox or container becomes unavailable, frameworks that silently degrade to less-isolated execution create an attack surface identical to running without sandboxing at all. This pattern has already appeared in MCP server implementations where transport failures fall back to STDIO without authentication.
  • Tool poisoning meets prompt injection. MCP tool descriptions are visible to models and can be manipulated. A malicious or compromised MCP tool description can inject instructions that exploit the same prompt-to-tool-execution path CrewAI exposed.
  • Cloud metadata SSRF is not theoretical. CVE-2026-2286 demonstrates that an agent with network access can reach cloud instance metadata — the same risk MCP servers face when deployed in cloud environments without network egress controls.
  • Supply-chain amplification. CrewAI is packaged in Docker images with insecure defaults. MCP server registries and package indexes face the same risk: a single misconfigured default propagates to every deployment that pulls the image without hardening.

Practical Defensive Takeaways

  1. Enforce Docker availability as a hard gate. If the CodeInterpreter cannot reach Docker, it should refuse to execute — not silently fall back. Deploy with --require-docker or equivalent policy, and monitor container health continuously.
  2. Disable the CodeInterpreter tool unless explicitly needed. Deployments that do not require code execution should remove the tool from agent configurations entirely. This eliminates the primary RCE surface.
  3. Segment agent network access. Run agent containers in network namespaces that cannot reach 169.254.169.254 or internal services. Use network policies (Kubernetes NetworkPolicy, iptables, cloud VPC rules) to block SSRF paths.
  4. Apply the CrewAI security patch. CrewAI released a patch addressing all four CVEs. Upgrade immediately if you are running any version prior to the patched release. Check CERT/CC VU#221883 for the latest vendor statement.
  5. Audit MCP tool servers for the same pattern. Inventory any MCP server that: (a) falls back to less-secure execution when a dependency is unavailable, (b) runs code on the host, or (c) makes outbound network requests on behalf of the model. Harden or replace each instance.
  6. Scan agent framework dependencies. Run pip audit, npm audit, or equivalent against your agent framework and all installed tools. Patch any dependency with known CVEs before deploying.

What Teams Should Check Next

  • Verify CrewAI version and patch status across all deployments — development, staging, and production.
  • Confirm Docker daemon health monitoring and alerting is active on every host running CrewAI agents.
  • Review network policies for any agent container or MCP server that can reach cloud metadata endpoints.
  • Inventory all MCP tool servers for silent fallback or unsafe default configurations.
  • Check if your organization’s AI agent deployments use RAG tools that make outbound HTTP requests — those are SSRF vectors under prompt injection.
  • Review MCPwatch’s MCP Security hub for related hardening guidance on MCP tool server deployment patterns.

Sources

Leave a Comment