Docker EUVD-2026-17117

Requires CrewAI with CodeInterpreter tool enabled. Victim must interact with a CrewAI application that attempts code execution when Docker daemon is unreachable, causing fallback to SandboxPython. Attacker-controlled input triggers arbitrary C function execution via the interpreter.

Risk assessment is constrained by missing formal CVSS and EPSS data, but qualitative signals indicate significant real-world risk. The attack vector is remote and does not require authentication (attackers submit code to CrewAI for execution), making accessibility high. Attack complexity is low once an attacker understands the fallback condition. The technical impact is severe: unrestricted code execution at the privilege level of the CrewAI process. The practical risk depends heavily on deployment context-CrewAI instances exposed to untrusted input or used in multi-tenant environments face acute risk. The vulnerability is not a high-CVSS-but-low-real-risk issue; rather, it represents a broken security assumption (Docker fallback as a safety mechanism) that fundamentally undermines the tool's security model. CISA KEV status and exploitation data are not provided, but the simplicity of the attack (trigger Docker unavailability, submit code exploiting C function access) suggests moderate to high exploitation probability once the fallback condition is triggered.

An attacker gains access to a CrewAI instance (either directly or via an application integrating CrewAI) at a moment when Docker is unavailable due to a network outage, misconfiguration, or service disruption. The attacker submits Python code to CrewAI for execution, which is processed by the CodeInterpreter tool. The tool detects Docker unavailability and falls back to SandboxPython. The attacker's code uses ctypes or similar mechanisms to call arbitrary C library functions (e.g., system, execve), bypassing SandboxPython's weak restrictions, and achieves remote code execution on the host system.