CrewAI Docker status check failure enables remote code execution
CrewAI failed to verify Docker availability at runtime, causing the system to fall back to an insecure sandbox mode. This vulnerability, tracked as CVE-2026-2287, allowed attackers to achieve remote code execution on the host machine.
CrewAI failing to properly check if Docker is still running at runtime and falling back to a sandbox setting that enables remote code execution.
Key facts
- What
- CrewAI failed to verify Docker availability at runtime, causing the system to fall back to an insecure sandbox mode.
- Incident date
- Mar 30, 2026
- Who
- CrewAI
- Failure mode
- Tool Misuse
- AI surface
- Agentic Workflow
- Severity
- High
What happened
CrewAI failed to verify if Docker was running during runtime. This caused the system to fall back to an insecure sandbox mode. Attackers could exploit this to achieve remote code execution on the host machine.
What broke inside the model
- 01 · TriggerThe agent selects the correct tool.
- 02 · Model stepIt fills the call with the wrong arguments.
- 03 · Control gapNo validation checks the arguments first.
- 04 · FailureThe tool runs against the wrong target.
- 05 · ConsequenceThe wrong record, account, or system is hit.
At the tool call, the arguments point at the wrong target.
The system lacked a runtime check for Docker availability. Instead of failing closed, it defaulted to an insecure execution environment. This fallback bypassed the intended isolation of the Docker container.
What it cost
Sources
- PrimaryCVE Record: CVE-2026-2287cve.org
- PressCrewAI Vulnerabilities Expose Devices to Hacking - SecurityWeeksecurityweek.com
- PrimaryMultiple Vulnerabilities in CrewAI Allow Sandbox Escape and Remote Code Execution via Prompt Injection - Thailand Computer Emergency Response Team (ThaiCERT)thaicert.or.th
Cite this entry
https://failureindex.ai/failures/crewai-docker-status-check-failure-enablesAI Failure Index. "CrewAI Docker status check failure enables remote code execution" (FI-0569). Realm Labs. https://failureindex.ai/failures/crewai-docker-status-check-failure-enables (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0569. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- OmniGuard
- AgentRealm
Realm can inspect a tool call against the user's actual intent before it runs, and hold calls whose arguments or target do not match what was asked, so the wrong tool or the wrong arguments never reach the system of record.