Crewai CVE-2026-2287

CrewAI application with Docker configured as sandbox runtime. When Docker daemon stops or becomes unavailable during execution, CrewAI falls back to an insecure sandbox mode. Remote unauthenticated attacker can trigger RCE by submitting malicious input to CrewAI agents.

Although CVSS and EPSS scores are unavailable, this vulnerability carries substantial real-world risk due to several factors: (1) the silent fallback behavior means compromised systems may not be detected or logged appropriately; (2) Docker availability is often assumed in infrastructure, making the fallback path exploitable in edge cases (daemon crashes, container restarts, network degradation); (3) the vulnerability requires only runtime conditions to trigger, not specific attacker capabilities; (4) RCE in an agent framework-which by design executes user-provided or dynamically generated code-is particularly severe; (5) CrewAI's integration into AI/ML pipelines suggests potential for high-impact lateral movement. The lack of CVSS data prevents quantitative severity comparison, but the combination of automatic unsafe fallback, RCE impact, and agent-based architecture elevates this above typical CVSS-only assessment. This aligns with SSVC criteria for high technical impact and likely automatable exploitation.

An attacker could induce Docker daemon failure on a system running CrewAI (e.g., via resource exhaustion, container escape, or misconfiguration), triggering the unsafe fallback sandbox mode. Once the application reverts to the weaker isolation mechanism, the attacker executes malicious instructions through CrewAI's agent interface or by poisoning the agent's task payload, achieving remote code execution with the privileges of the CrewAI process. In an AI/ML pipeline context, this could allow exfiltration of training data, model weights, or lateral movement within the infrastructure.