What is the CVSS score of CVE-2026-2287?

CVE-2026-2287 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Docker CVE-2026-2287

EUVD-2026-17123 CRITICAL

Code Injection (CWE-94)

2026-03-30 cret@cert.org

Docker RCE Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 16:22 euvd

EUVD-2026-17123

Analysis Generated

Mar 30, 2026 - 16:22 vuln.today

CVE Published

Mar 30, 2026 - 16:16 nvd

CRITICAL 9.8

DescriptionCVE.org

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation.

AnalysisAI

CrewAI fails to validate Docker runtime availability during execution and silently reverts to an insecure sandbox mode, enabling remote code execution. Affected versions prior to the patch rely on Docker for isolation; when Docker becomes unavailable or is misconfigured, the fallback mechanism does not enforce adequate sandboxing constraints, allowing attackers to execute arbitrary commands within the application context. No CVSS score or official CVE details are available at this time, though the vulnerability has been reported to CERT and carries high practical risk due to the automatic unsafe fallback behavior.

Technical ContextAI

CrewAI is an agent framework that leverages containerization (Docker) as a primary security boundary for isolating agent execution environments. The vulnerability arises from insufficient runtime validation logic: the application does not robustly check Docker daemon status or container health before attempting to spawn isolated execution contexts. When Docker becomes unavailable-due to daemon crash, misconfiguration, or network partition-the code falls back to a less-restrictive sandbox mode without proper compensating controls. This fallback mechanism does not maintain the same isolation guarantees as the containerized execution path, effectively downgrading the security posture without user awareness. The root cause appears to be a missing or inadequate guard condition in the execution path selection logic (CWE class: improper input validation, error handling, or security control bypass).

RemediationAI

Upgrade CrewAI to the patched version released by the maintainers. Exact patched version numbers are not specified in the provided data; consult the CERT advisory (https://www.kb.cert.org/vuls/id/221883) and the CrewAI project repository for the minimum patched release. As an interim workaround, ensure Docker daemon is always running and healthily monitored before executing CrewAI agents; implement startup checks and runtime monitoring to detect Docker unavailability and fail-safe (do not fall back to sandbox mode). Additionally, run CrewAI agents within a restrictive container environment or with SELinux/AppArmor policies to constrain fallback execution. Review application logs and execution traces for evidence of sandbox fallback activation.