CVE-2026-2287: Crewai Crewai RCE Vulnerability

CVE-2026-2287 Overview

CVE-2026-2287 affects CrewAI, an open-source framework for orchestrating role-playing autonomous AI agents. The framework fails to verify that Docker remains active during runtime execution. When Docker becomes unavailable, CrewAI silently falls back to an insecure sandbox configuration that permits arbitrary code execution. This fallback behavior enables remote code execution (RCE) against agent workloads processing untrusted input. The flaw is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
A network-reachable attacker can achieve unauthenticated remote code execution on CrewAI hosts when Docker is not running, fully compromising confidentiality, integrity, and availability.

Affected Products

CrewAI 1.0.0
Deployments relying on Docker-backed code execution sandboxing
Agent workflows that process untrusted prompts or tool outputs

Discovery Timeline

2026-03-30 - CVE-2026-2287 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-2287

Vulnerability Analysis

CrewAI executes agent-generated code inside a Docker container to isolate untrusted instructions and tool calls. The framework checks for Docker availability at initialization but does not re-validate the Docker daemon state during runtime. If the Docker service stops, crashes, or is unreachable after the agent starts, the executor falls back to a permissive local sandbox. That fallback runs code directly on the host process, bypassing the intended isolation boundary.

The CWE-94 classification reflects improper control over how generated code is executed. Because CrewAI agents routinely process attacker-influenced inputs such as prompts, retrieved documents, and tool responses, the missing runtime check turns a reliability issue into a remote code execution path.

Root Cause

The sandbox selection logic evaluates Docker availability only once and caches the result. The executor lacks a health probe before dispatching code to the container backend. When the Docker call fails at execution time, the code path silently downgrades to an in-process execution mode rather than aborting the task.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits malicious instructions through any input channel the agent consumes — chat prompts, retrieval-augmented documents, web tool responses, or upstream API data. If Docker is unavailable on the host, the injected code executes with the privileges of the CrewAI process. See the CERT Vulnerability Note #221883 for additional technical context.

// No verified public exploit code is available.
// The vulnerability is triggered by routine agent execution
// when the Docker daemon is not running on the host.

Detection Methods for CVE-2026-2287

Indicators of Compromise

Unexpected child processes spawned by the CrewAI Python interpreter, particularly shell, network, or file-system utilities
CrewAI logs showing sandbox initialization succeeding while docker ps or the Docker socket are unavailable
Outbound network connections from the CrewAI host to unfamiliar destinations during agent runs

Detection Strategies

Correlate Docker daemon status with CrewAI execution events to flag agent runs that proceeded without container isolation
Hunt for process lineage where python or crewai parents spawn interpreters, compilers, or system administration binaries
Inspect agent inputs and tool outputs for code-like payloads, encoded commands, or prompt injection patterns

Monitoring Recommendations

Alert when the Docker service stops on hosts running CrewAI workloads
Capture command-line telemetry and file writes from CrewAI processes for retrospective analysis
Track outbound DNS and HTTP requests from agent hosts to identify command-and-control or data exfiltration attempts

How to Mitigate CVE-2026-2287

Immediate Actions Required

Verify the Docker daemon is running and monitored on every host executing CrewAI agents
Disable or remove the insecure local sandbox fallback in CrewAI configuration where supported
Restrict CrewAI service accounts to the minimum file-system, network, and credential access required
Treat all agent inputs, retrieved content, and tool outputs as untrusted and apply prompt-injection defenses

Patch Information

No vendor patch reference is listed in the NVD record at publication time. Consult the CERT Vulnerability Note #221883 and the CrewAI project for upgrade guidance, and pin to a fixed release once available.

Workarounds

Run CrewAI inside a dedicated container or virtual machine so the host boundary contains any sandbox escape
Configure a process supervisor that halts CrewAI when the Docker daemon is unavailable
Apply egress network controls to block outbound traffic from CrewAI hosts to untrusted destinations

bash

# Configuration example: fail closed when Docker is unavailable
systemctl is-active --quiet docker || {
  echo "Docker is not running. Refusing to start CrewAI." >&2
  exit 1
}

# Launch CrewAI only after Docker health is confirmed
exec crewai run --config /etc/crewai/config.yaml