EXPOSURE CrewAI Studio
SEVERITY HIGH
PROBE GET :8000/auth/login
Is your CrewAI Studio exposed?
Control plane login public: crews, flows and model credentials behind it.
Scan a host you own → Fix card Census
Why it matters
CrewAI Studio is the control plane for multi-agent crews and flows. A public login page means strangers can reach the surface that holds crew definitions and model credentials.
How common is it?
14 CrewAI Studio instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.title:"CrewAI"` · 2026-08
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: