AIKIDO-2026-11090
crewai is vulnerable to Information Disclosure
75
High Risk
This Affects:
crewaiTL;DR
When connecting to MCP servers over stdio, the framework previously copied the full parent process environment into the spawned subprocess, exposing ambient secrets such as cloud credentials to the MCP server. Agents configured with both tools and a structured response format also passed the response schema to the LLM on every tool-calling loop turn, which could leak internal structured state into intermediate outputs. The fix restricts stdio MCP subprocess environments to SDK defaults plus explicitly supplied variables and stops applying structured output shaping during tool-calling iterations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
crewai is vulnerable to Information Disclosure in versions 1.5.0 - 1.14.5.
How to fix this
Upgrade the crewai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant