What happened
VulnCheck published (2026-10-19) an SSRF in crewai-tools' SeleniumScrapingTool, which fails to reject private-address URLs. CVSS 7.4 (v3.1, scope-changed) / 8.3 (v4.0), CWE-918. An attacker who steers an agent's tool input through prompt injection can exfiltrate internal data and cloud tenant credentials.
Why it matters
In an agentic deployment the scraper is a high-privilege browser; an SSRF that ignores private-address checks gives a prompt-injected agent a live path to cloud metadata and internal infrastructure, a common step in cloud-account takeover chains.
Attack vector
SeleniumScrapingTool never applies the validate_url private-address check before directing headless Chrome at a target URL. An attacker influencing agent tool input via prompt injection can point the scraper at internal services or cloud metadata endpoints to disclose internal data and cloud credentials (CWE-918).
Affected systems
crewai-tools through 1.15.28 (CrewAI)
Mitigation
Update crewai-tools to a patched release (fix referenced in crewAI PR #6870).