Disclosed vulnerability
CrewAI cluster: CodeInterpreter silently falls back out of Docker to an escapable Python sandbox, plus SSRF and arbitrary file read in the RAG tools
AIR-2026-0082 AIR record · 2026-03-crewai-code-interpreter-and-tool-flaws
From the supporting source
The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling.github.com
The record
Disclosed
2026-03-30
Vendor
CrewAI Inc.
Product
CrewAI and crewai-tools
Risk domain
Agent output quality › Hallucination
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the code interpreter executed agent-generated code outside Docker
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Agent generated code and runtime supplied urls
Impact type
Remote code execution, Sandbox escape, Ssrf, Arbitrary file read
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI08 – Cascading Failures
- MITRE ATLAS
- AML.T0062 – Discover LLM Hallucinations
- NIST AI RMF
- MEASURE 2.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 24029-1
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
CrewAI deployments using CodeInterpreter without a reachable Docker daemon, and any CrewAI RAG tool taking a runtime URL
Capability abused
Defense & remediation
Recorded defense
Docker-based isolation for the CodeInterpreter tool, and URL validation in the RAG search tools
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
per-CVE patches in CrewAI and crewai-tools; the CodeInterpreter fallback path was the primary fix
Taxonomy & references
Curator notes
Four advisories published the same day (2026-03-30) and grouped as one disclosure event: CVE-2026-2275 (CodeInterpreter Docker-to-SandboxPython fallback, CVSS 9.6 Critical, CWE-749), CVE-2026-2287 (Docker runtime check failure, Critical), CVE-2026-2286 (SSRF in RAG search tools via unvalidated runtime URLs, CVSS 9.8 Critical, CWE-918 - 'enables content acquisition from internal and cloud services'), CVE-2026-2285 (JSON loader arbitrary file read, High). Later separate crewai-tools advisories CVE-2026-37007 (FileWriterTool) and CVE-2026-37009 (SQL injection in NL2SQLTool) are not covered here. This is the fail-open-sandbox pattern that Microsoft predicted would recur across frameworks.
Supporting sources
Cite as
Enkrypt AI. "CrewAI cluster: CodeInterpreter silently falls back out of Docker to an escapable Python sandbox, plus SSRF and arbitrary file read in the RAG tools". AIR, AIR-2026-0082. https://agentincident.vercel.app/i/AIR-2026-0082/ (accessed 2026-10-19).