agent-threat-rules 4.0.0 → 4.2.0

package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml

@@ -1,87 +1,62 @@
-title: "CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)"
+title: CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)
 id: ATR-2026-00546
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2026-2285 (CVSS HIGH, CWE-22): CrewAI's JSON document loader
-  accepts a file path without sanitisation, allowing an agent or tool input
-  to traverse outside the intended data directory and read arbitrary local
-  files (e.g., /etc/passwd, ~/.ssh/id_rsa, .env secrets) by supplying a
-  path-traversal sequence in the loader argument.
-
-  The vulnerability is part of the CERT/CC VU#221883 advisory cluster
-  (four CrewAI CVEs, 2026-03-30). The JSON loader is invoked when CrewAI
-  processes RAG documents; a crafted document path causes the loader to
-  return the contents of an attacker-specified file, which the agent then
-  includes in its context and may exfiltrate via subsequent tool calls.
-
-  Detection covers:
-  (a) Path-traversal sequences in JSON loader file path arguments;
-  (b) Absolute paths to sensitive files (e.g., /etc/passwd, .env, .ssh);
-  (c) CrewAI document loader with directory traversal or sensitive-file targets;
-  (d) Explicit CVE-2026-2285 / CrewAI JSON loader file-read framing.
-author: "ATR Community"
-date: "2026/05/28"
-schema_version: "0.1"
+description: |
+  Detects CVE-2026-2285 (CVSS HIGH, CWE-22): CrewAI's JSON document loader accepts a file path without sanitisation, allowing an agent or tool input to traverse outside the intended data directory and read arbitrary local files (e.g., /etc/passwd, ~/.ssh/id_rsa, .env secrets) by supplying a path-traversal sequence in the loader argument.
+  The vulnerability is part of the CERT/CC VU#221883 advisory cluster (four CrewAI CVEs, 2026-03-30). The JSON loader is invoked when CrewAI processes RAG documents; a crafted document path causes the loader to return the contents of an attacker-specified file, which the agent then includes in its context and may exfiltrate via subsequent tool calls.
+  Detection covers: (a) Path-traversal sequences in JSON loader file path arguments; (b) Absolute paths to sensitive files (e.g., /etc/passwd, .env, .ssh); (c) CrewAI document loader with directory traversal or sensitive-file targets; (d) Explicit CVE-2026-2285 / CrewAI JSON loader file-read framing.
+author: ATR Community
+date: 2026/05/28
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
-
 references:
   owasp_llm:
-    - "LLM06:2025"
-    - "LLM05:2025"
+    - LLM06:2025
+    - LLM05:2025
   owasp_agentic:
-    - "ASI03:2026"
+    - ASI03:2026
   mitre_atlas:
-    - "AML.T0043 - Craft Adversarial Data"
+    - AML.T0043 - Craft Adversarial Data
   mitre_attack:
-    - "T1083 - File and Directory Discovery"
-    - "T1552 - Unsecured Credentials"
+    - T1083 - File and Directory Discovery
+    - T1552 - Unsecured Credentials
   cve:
-    - "CVE-2026-2285"
-
+    - CVE-2026-2285
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: >
-        CVE-2026-2285 allows arbitrary local file read via the CrewAI JSON
-        loader without path sanitisation; Article 15 cybersecurity requirements
-        mandate that AI agent document loaders canonicalise paths and restrict
-        access to the intended data directory.
+    - article: '15'
+      context: |
+        CVE-2026-2285 allows arbitrary local file read via the CrewAI JSON loader without path sanitisation; Article 15 cybersecurity requirements mandate that AI agent document loaders canonicalise paths and restrict access to the intended data directory.
       strength: primary
-    - article: "14"
-      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) would bypass or undermine that oversight."
+    - article: '14'
+      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) would bypass or undermine that oversight.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: >
-        Path traversal in a document loader argument enabling sensitive file
-        read constitutes an adversarial input; MP.5.1 requires scanning
-        document loader path arguments for traversal sequences.
+    - subcategory: MP.5.1
+      context: |
+        Path traversal in a document loader argument enabling sensitive file read constitutes an adversarial input; MP.5.1 requires scanning document loader path arguments for traversal sequences.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)).
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) so the risk can be treated.
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: >
-        Operational controls must detect and block document loader invocations
-        with path traversal sequences targeting sensitive files outside the
-        intended data scope.
+    - clause: '8.1'
+      context: |
+        Operational controls must detect and block document loader invocations with path traversal sequences targeting sensitive files outside the intended data scope.
       strength: primary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)) is such a treatment.
       strength: secondary
-
 tags:
   category: privilege-escalation
   subcategory: path-traversal-file-read
@@ -89,7 +64,6 @@ tags:
   confidence: high
   source: cve-disclosure
   vendor_sources: crewai-vu221883
-
 agent_source:
   type: llm_io
   framework:
@@ -97,77 +71,32 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Legitimate document loaders referencing known-good data directories — pattern requires traversal or sensitive-file targets."
-    - "Security advisory text quoting CVE-2026-2285 file paths."
-    - "References to /etc/ in system administration documentation without traversal context."
+    - Legitimate document loaders referencing known-good data directories — pattern requires traversal or sensitive-file targets.
+    - Security advisory text quoting CVE-2026-2285 file paths.
+    - References to /etc/ in system administration documentation without traversal context.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)(?:json[_-]?loader|load[_-]?json|JSONLoader|document[_-]?loader)[^\n]{0,200}(?:(?:\.\.\/|\.\.\\){2,}|(?:\/etc\/(?:passwd|shadow|hosts)|\/root\/|\/home\/[^/]+\/\.ssh|\.env|\.aws\/credentials|\.npmrc|id_rsa))'
-      description: >
-        JSON/document loader invocation with either a path-traversal sequence
-        (2+ levels up) or a known sensitive-file target — CVE-2026-2285
-        local file read via CrewAI document loader
-
+      value: (?i)(?:json[_-]?loader|load[_-]?json|JSONLoader|document[_-]?loader)[^\n]{0,200}(?:(?:\.\.\/|\.\.\\){2,}|(?:\/etc\/(?:passwd|shadow|hosts)|\/root\/|\/home\/[^/]+\/\.ssh|\.env|\.aws\/credentials|\.npmrc|id_rsa))
+      description: |
+        JSON/document loader invocation with either a path-traversal sequence (2+ levels up) or a known sensitive-file target — CVE-2026-2285 local file read via CrewAI document loader
     - field: content
       operator: regex
-      value: '(?i)(?:crewai|crew_ai|CrewAI)[^\n]{0,200}(?:json[_-]?loader|load[_-]?json|document[_-]?loader)[^\n]{0,200}(?:\.\.\/|\/etc\/|\.env|\.ssh|id_rsa|credentials)'
-      description: >
-        CrewAI combined with a document/JSON loader and a sensitive path
-        or traversal sequence — attack framing specific to CVE-2026-2285
-
+      value: (?i)(?:crewai|crew_ai|CrewAI)[^\n]{0,200}(?:json[_-]?loader|load[_-]?json|document[_-]?loader)[^\n]{0,200}(?:\.\.\/|\/etc\/|\.env|\.ssh|id_rsa|credentials)
+      description: |
+        CrewAI combined with a document/JSON loader and a sensitive path or traversal sequence — attack framing specific to CVE-2026-2285
     - field: content
       operator: regex
-      value: '(?i)(?:CVE-2026-2285|crewai[^\n]{0,80}(?:file[_\s-]?read|local[_\s-]?file|json[_\s-]?loader))[^\n]{0,200}(?:inject|read|exfil|bypass|traverse|sensitive|passwd|\.env|\.ssh)'
-      description: >
-        Explicit CVE-2026-2285 reference or CrewAI file-read framing combined
-        with exploitation language or sensitive file targets
-
+      value: (?i)(?:CVE-2026-2285|crewai[^\n]{0,80}(?:file[_\s-]?read|local[_\s-]?file|json[_\s-]?loader))[^\n]{0,200}(?:inject|read|exfil|bypass|traverse|sensitive|passwd|\.env|\.ssh)
+      description: |
+        Explicit CVE-2026-2285 reference or CrewAI file-read framing combined with exploitation language or sensitive file targets
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-00546] HIGH: CrewAI JSON loader with path traversal or
-    sensitive-file target detected (CVE-2026-2285, CWE-22). The CrewAI JSON
-    loader does not sanitise document paths, allowing traversal to read
-    arbitrary local files (/etc/passwd, .env, SSH keys). Block this loader
-    call; canonicalise document paths and restrict loader access to the
-    intended data directory. Part of VU#221883 advisory cluster — upgrade
-    CrewAI to the patched version.
-
+  message_template: |
+    [ATR-2026-00546] HIGH: CrewAI JSON loader with path traversal or sensitive-file target detected (CVE-2026-2285, CWE-22). The CrewAI JSON loader does not sanitise document paths, allowing traversal to read arbitrary local files (/etc/passwd, .env, SSH keys). Block this loader call; canonicalise document paths and restrict loader access to the intended data directory. Part of VU#221883 advisory cluster — upgrade CrewAI to the patched version.
 confidence: 80
-
-
-test_cases:
-  true_positives:
-    - input: "JSONLoader('../../../../etc/passwd')"
-      expected: triggered
-      description: "JSON loader with path traversal to /etc/passwd"
-    - input: "document_loader path: ../../../.env"
-      expected: triggered
-      description: "Document loader with traversal to .env secrets file"
-    - input: "crewai json_loader ../../.ssh/id_rsa exfil CVE-2026-2285"
-      expected: triggered
-      description: "CrewAI JSON loader + SSH key + CVE reference"
-    - input: "JSONLoader('/root/.aws/credentials')"
-      expected: triggered
-      description: "JSON loader with absolute path to AWS credentials"
-    - input: "CVE-2026-2285: CrewAI JSON loader reads /etc/passwd via unsanitised path"
-      expected: triggered
-      description: "CVE-2026-2285 exploitation framing with sensitive file target"
-
-  true_negatives:
-    - input: "JSONLoader('/data/documents/report.json')"
-      expected: not_triggered
-      description: "Legitimate JSON loader with a safe absolute data path"
-    - input: "crewai loads documents from the /tmp/uploads/ directory"
-      expected: not_triggered
-      description: "Normal CrewAI document directory reference — no traversal"
-    - input: "Upgrade CrewAI to fix CVE-2026-2285"
-      expected: not_triggered
-      description: "Mitigation advisory without exploit content"

package/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml

@@ -1,89 +1,66 @@
-title: "CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)"
+title: CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)
 id: ATR-2026-00547
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2026-2286 (CVSS HIGH, CWE-918): CrewAI's RAG (retrieval-augmented
-  generation) URL validator can be bypassed by URL encoding, mixed-case,
-  or alternative representations (decimal IP, hex IP, IPv6 loopback, DNS
-  rebinding shapes) to perform server-side request forgery against internal
-  services on the CrewAI host network.
-
-  The vulnerability is part of the CERT/CC VU#221883 advisory cluster
-  (four CrewAI CVEs, 2026-03-30). An agent or tool input that passes a
-  crafted RAG source URL causes CrewAI to make internal HTTP requests to
-  metadata services (e.g., AWS IMDS 169.254.169.254), internal APIs, or
-  services on private RFC-1918 ranges — enabling cloud credential theft,
-  internal service enumeration, or lateral movement.
-
-  Detection covers:
-  (a) RAG source URLs containing SSRF bypass representations of loopback /
+description: |
+  Detects CVE-2026-2286 (CVSS HIGH, CWE-918): CrewAI's RAG (retrieval-augmented generation) URL validator can be bypassed by URL encoding, mixed-case, or alternative representations (decimal IP, hex IP, IPv6 loopback, DNS rebinding shapes) to perform server-side request forgery against internal services on the CrewAI host network.
+  The vulnerability is part of the CERT/CC VU#221883 advisory cluster (four CrewAI CVEs, 2026-03-30). An agent or tool input that passes a crafted RAG source URL causes CrewAI to make internal HTTP requests to metadata services (e.g., AWS IMDS 169.254.169.254), internal APIs, or services on private RFC-1918 ranges — enabling cloud credential theft, internal service enumeration, or lateral movement.
+  Detection covers: (a) RAG source URLs containing SSRF bypass representations of loopback /
       link-local / private IP ranges;
   (b) URL-encoded, hex, octal, or decimal IP representations of internal
       addresses in RAG contexts;
-  (c) CrewAI RAG with cloud metadata endpoint patterns (169.254.169.254);
-  (d) Explicit CVE-2026-2286 / CrewAI SSRF framing.
-author: "ATR Community"
-date: "2026/05/28"
-schema_version: "0.1"
+  (c) CrewAI RAG with cloud metadata endpoint patterns (169.254.169.254); (d) Explicit CVE-2026-2286 / CrewAI SSRF framing.
+author: ATR Community
+date: 2026/05/28
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
-
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI03:2026"
-    - "ASI05:2026"
+    - ASI03:2026
+    - ASI05:2026
   mitre_atlas:
-    - "AML.T0043 - Craft Adversarial Data"
+    - AML.T0043 - Craft Adversarial Data
   mitre_attack:
-    - "T1090 - Proxy"
-    - "T1552.005 - Cloud Instance Metadata API"
+    - T1090 - Proxy
+    - T1552.005 - Cloud Instance Metadata API
   cve:
-    - "CVE-2026-2286"
-
+    - CVE-2026-2286
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: >
-        CVE-2026-2286 allows bypassing CrewAI RAG URL validation to perform
-        SSRF against internal services and cloud metadata APIs; Article 15
-        cybersecurity requirements mandate robust URL validation that blocks
-        all representations of internal addresses.
+    - article: '15'
+      context: |
+        CVE-2026-2286 allows bypassing CrewAI RAG URL validation to perform SSRF against internal services and cloud metadata APIs; Article 15 cybersecurity requirements mandate robust URL validation that blocks all representations of internal addresses.
       strength: primary
-    - article: "14"
-      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) would bypass or undermine that oversight."
+    - article: '14'
+      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) would bypass or undermine that oversight.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: >
-        SSRF bypass via crafted RAG URLs targeting cloud metadata or internal
-        services constitutes an adversarial input; MP.5.1 requires scanning
-        RAG source URLs for SSRF bypass patterns.
+    - subcategory: MP.5.1
+      context: |
+        SSRF bypass via crafted RAG URLs targeting cloud metadata or internal services constitutes an adversarial input; MP.5.1 requires scanning RAG source URLs for SSRF bypass patterns.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)).
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) so the risk can be treated.
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: >
-        Operational controls must detect and block RAG URL inputs containing
-        SSRF bypass representations of internal or link-local addresses.
+    - clause: '8.1'
+      context: |
+        Operational controls must detect and block RAG URL inputs containing SSRF bypass representations of internal or link-local addresses.
       strength: primary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (CrewAI RAG URL Validation Bypass SSRF (CVE-2026-2286)) is such a treatment.
       strength: secondary
-
 tags:
   category: privilege-escalation
   subcategory: ssrf-rag-url-bypass
@@ -91,7 +68,6 @@ tags:
   confidence: high
   source: cve-disclosure
   vendor_sources: crewai-vu221883
-
 agent_source:
   type: llm_io
   framework:
@@ -99,82 +75,32 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Security research tools probing SSRF bypass patterns for testing — rule fires by design."
-    - "Security advisory text quoting CVE-2026-2286 SSRF payloads."
-    - "Legitimate document URLs that contain the string '169' or '127' in path components — evaluate context."
+    - Security research tools probing SSRF bypass patterns for testing — rule fires by design.
+    - Security advisory text quoting CVE-2026-2286 SSRF payloads.
+    - Legitimate document URLs that contain the string '169' or '127' in path components — evaluate context.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)(?:rag|retrieval[_-]?augmented|source[_-]?url|document[_-]?url)[^\n]{0,200}(?:169\.254\.169\.254|fd00:|2130706433|0x7f000001|0177\.0\.0\.1|[a-z0-9-]+\.internal\.|(?:127\.0\.[01]\.[01]|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})(?::\d+)?/)'
-      description: >
-        RAG source URL containing a cloud metadata endpoint (169.254.169.254),
-        decimal/hex/octal loopback representations, or an RFC-1918 private
-        address followed by an internal resource path — SSRF bypass via
-        CVE-2026-2286. Plain "localhost:PORT" / bare-IP server defaults (no
-        path) are excluded so legitimate RAG deployment docs do not false-positive.
-
+      value: (?i)(?:rag|retrieval[_-]?augmented|source[_-]?url|document[_-]?url)[^\n]{0,200}(?:169\.254\.169\.254|fd00:|2130706433|0x7f000001|0177\.0\.0\.1|[a-z0-9-]+\.internal\.|(?:127\.0\.[01]\.[01]|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})(?::\d+)?/)
+      description: |
+        RAG source URL containing a cloud metadata endpoint (169.254.169.254), decimal/hex/octal loopback representations, or an RFC-1918 private address followed by an internal resource path — SSRF bypass via CVE-2026-2286. Plain "localhost:PORT" / bare-IP server defaults (no path) are excluded so legitimate RAG deployment docs do not false-positive.
     - field: content
       operator: regex
-      value: '(?i)(?:rag|retrieval[_-]?augmented|source[_-]?url|document[_-]?url)[^\n]{0,200}(?:%31%36%39|%31%32%37|\\u0031|%2e%2e|\\x31\\x36\\x39|0x[aAbBcC][0-9a-fA-F]{6})'
-      description: >
-        RAG URL with URL-encoded, Unicode-escaped, or hex representations
-        of SSRF-relevant IP octets — URL encoding bypass pattern
-
+      value: (?i)(?:rag|retrieval[_-]?augmented|source[_-]?url|document[_-]?url)[^\n]{0,200}(?:%31%36%39|%31%32%37|\\u0031|%2e%2e|\\x31\\x36\\x39|0x[aAbBcC][0-9a-fA-F]{6})
+      description: |
+        RAG URL with URL-encoded, Unicode-escaped, or hex representations of SSRF-relevant IP octets — URL encoding bypass pattern
     - field: content
       operator: regex
-      value: '(?i)(?:CVE-2026-2286|crewai[^\n]{0,80}(?:ssrf|rag[_\s-]?url|url[_\s-]?bypass|metadata))[^\n]{0,200}(?:inject|bypass|exfil|metadata|169\.254|internal|private[_\s-]?ip)'
-      description: >
-        Explicit CVE-2026-2286 reference or CrewAI SSRF framing combined
-        with exploitation language or internal IP patterns
-
+      value: (?i)(?:CVE-2026-2286|crewai[^\n]{0,80}(?:ssrf|rag[_\s-]?url|url[_\s-]?bypass|metadata))[^\n]{0,200}(?:inject|bypass|exfil|metadata|169\.254|internal|private[_\s-]?ip)
+      description: |
+        Explicit CVE-2026-2286 reference or CrewAI SSRF framing combined with exploitation language or internal IP patterns
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-00547] HIGH: CrewAI RAG URL with SSRF bypass pattern detected
-    (CVE-2026-2286, CWE-918). CrewAI's RAG URL validator can be bypassed
-    by encoded or alternative representations of internal/metadata addresses,
-    enabling SSRF against cloud metadata services (169.254.169.254) or
-    internal APIs. Block this URL; enforce a server-side URL allowlist that
-    resolves to canonical form before validation. Part of VU#221883 —
-    upgrade CrewAI to the patched version.
-
+  message_template: |
+    [ATR-2026-00547] HIGH: CrewAI RAG URL with SSRF bypass pattern detected (CVE-2026-2286, CWE-918). CrewAI's RAG URL validator can be bypassed by encoded or alternative representations of internal/metadata addresses, enabling SSRF against cloud metadata services (169.254.169.254) or internal APIs. Block this URL; enforce a server-side URL allowlist that resolves to canonical form before validation. Part of VU#221883 — upgrade CrewAI to the patched version.
 confidence: 82
-
-
-test_cases:
-  true_positives:
-    - input: "rag_source_url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"
-      expected: triggered
-      description: "RAG URL targeting AWS IMDS cloud metadata endpoint"
-    - input: "document_url=http://127.0.0.1:8080/internal-api/admin"
-      expected: triggered
-      description: "RAG URL targeting localhost internal API"
-    - input: "source_url: http://2130706433/  # decimal representation of 127.0.0.1"
-      expected: triggered
-      description: "Decimal IP SSRF bypass for loopback"
-    - input: "rag url http://0x7f000001/ bypass CVE-2026-2286"
-      expected: triggered
-      description: "Hex IP SSRF bypass with CVE reference"
-    - input: "CVE-2026-2286: CrewAI RAG URL validation bypass allows SSRF via encoded internal addresses"
-      expected: triggered
-      description: "CVE-2026-2286 exploitation framing"
-    - input: "retrieval_augmented url: http://192.168.1.1/router/config"
-      expected: triggered
-      description: "RAG URL targeting RFC-1918 private network address"
-
-  true_negatives:
-    - input: "rag_source_url: https://docs.example.com/api-reference.json"
-      expected: not_triggered
-      description: "Legitimate RAG URL with external public domain"
-    - input: "crewai retrieves documents from https://arxiv.org/abs/2312.12345"
-      expected: not_triggered
-      description: "Normal CrewAI RAG with public research paper URL"
-    - input: "Upgrade CrewAI to fix CVE-2026-2286"
-      expected: not_triggered
-      description: "Mitigation advisory without exploit content"