EUVD-2026-21158
GHSA-8frj-8q3m-xhgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to /api/v1/runs endpoint
-
ExploitInject arbitrary webhook_url parameter
-
ExecutionServer performs HTTP POST to attacker-controlled destination
-
ImpactAccess internal cloud metadata or APIs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | PraisonAI versions prior to 4.5.128. Attacker sends unauthenticated HTTP POST request to /api/v1/runs endpoint with arbitrary webhook_url parameter. No victim interaction required. Server automatically makes POST request to attacker-controlled URL upon job completion. |
| Impact | CVSS 7.2 reflects moderate impact: unauthenticated SSRF via unvalidated webhook_url on /api/v1/runs endpoint. Network-adjacent blast radius includes cloud metadata service exfiltration and internal API compromise. Elevated observed exploitation activity indicates active probing. Critical for cloud-deployed PraisonAI instances; lower risk for isolated networks. |
| Exploit ScenarioDerived | Attacker submits POST to /api/v1/runs with malicious webhook_url pointing to 169.254.169.254 (AWS metadata). Job completion triggers server POST to attacker-controlled destination, exfiltrating instance credentials. No authentication required; single HTTP request initiates chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Server-Side Request Forgery in PraisonAI versions prior to 4.5.128 allows unauthenticated remote attackers to force the server to send HTTP POST requests to arbitrary internal or external destinations via an unvalidated webhook_url parameter in the /api/v1/runs endpoint. Attackers can abuse this to access cloud metadata services (AWS/GCP/Azure instance metadata), internal APIs, and network-adjacent services, potentially exposing credentials, configuration data, or triggering unauthorized actions. No public exploit identified at time of analysis. CVSS 7.2 indicates changed scope with low confidentiality and integrity impact.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later immediately. This release implements URL validation on the /api/v1/runs webhook_url parameter to prevent SSRF. Until upgrade is completed, implement network-level egress filtering to block server outbound connections to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and localhost (127.0.0.0/8). Deploy Web Application Firewall rules to reject requests containing suspicious webhook_url values. Review application logs for unauthorized callback attempts to internal endpoints. For full details, see GitHub Security Advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8frj-8q3m-xhgm
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-918 SSRF via webhook_url parameter accepted without validation. Vulnerable httpx.AsyncClient POST implementation triggers on job completion callbacks, enabling blind SSRF. Lack of URL allowlisting/blocklisting permits internal network enumeration (RFC 1918 addresses, 169.254.169.254 metadata endpoints) and external exfiltration channels. Changed scope (S:C) reflects cross-tenant risk in multi-user deployments.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When a submitted job completes (success or failure), the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server send POST requests to arbitrary internal or external destinations, enabling SSRF against cloud metadata services, internal APIs, and other network-adjacent services. This vulnerability is fixed in 4.5.128.
Executive ViewAI
PraisonAI versions before 4.5.128 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate the application into making unauthorized HTTP requests to internal systems and cloud metadata services. Organizations using PraisonAI risk exposure of cloud credentials, internal API data, and configuration secrets without requiring authentication. This vulnerability requires immediate action to prevent lateral movement and credential compromise in connected infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to /api/v1/runs endpoint at the perimeter and application firewall level; (2) Implement strict URL allowlist for webhook_url parameter to prevent arbitrary destinations; (3) Disable webhook functionality entirely if not operationally required; (4) Deploy egress filtering to block server connections to cloud metadata services (169.254.169.254 for AWS, etc.); (5) Monitor outbound POST requests from PraisonAI processes for anomalous destinations; (6) Rotate all cloud credentials and API tokens with potential exposure to the affected system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Exploit-DB