CVE-2026-2287

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cret@cert.org

Published

2026-03-30

Last modified

2026-04-01

Weaknesses

CWE-94

Affected products

• Crewai (Crewai)

References

• https://www.kb.cert.org/vuls/id/221883