EUVD-2026-21170
GHSA-8f4v-xfm9-3244
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInject malicious URL via prompt injection
-
ExploitAI agent passes URL to web_crawl()
-
ExecutionFunction fetches internal metadata endpoint
-
ImpactAttacker retrieves sensitive cloud credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to PraisonAIAgents versions prior to 1.5.128 with ability to control AI agent prompts or inject URLs into crawled content. The web_crawl() function accepts unvalidated URLs (including file://, cloud metadata endpoints, private IPs) without scheme allowlisting or hostname blocklisting. |
| Impact | CVSS 7.7 reflects high confidentiality impact via SSRF; authenticated agents bypass URL validation to access metadata endpoints and internal services. Moderate observed exploitation activity. Organizations running PraisonAIAgents with untrusted prompts face credential leakage and lateral reconnaissance risks. Upgrade to 1.5.128 immediately; restrict agent internet access pending patches. |
| Exploit ScenarioDerived | Attacker injects prompt directing AI agent to crawl http://169.254.169.254/latest/meta-data (AWS) or internal service URL. Agent's web_crawl() function lacks hostname validation, fetches request unauthenticated to internal network, exfiltrates credentials or service config. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal network reconnaissance and data exfiltration through unvalidated URL crawling. The web_crawl() function in versions prior to 1.5.128 accepts arbitrary URLs from AI agents without scheme allowlisting, hostname blocking, or private network checks, enabling access to cloud metadata endpoints (AWS/Azure/GCP), internal services, and local filesystems via file:// URIs. Exploitation requires low-privileged authenticated access with network reachability and no user interaction. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: version 1.5.128 implements URL validation controls including scheme allowlisting and private network filtering. Organizations must upgrade immediately to 1.5.128 or later. Review application logs for historical SSRF attempts targeting RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8, ::1), and cloud metadata endpoints (169.254.169.254, fd00:ec2::254). As temporary workaround if upgrade delayed, implement network egress filtering to block agent worker processes from accessing internal networks and apply web application firewall rules rejecting file://, gopher://, dict:// schemes. Vendor advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is absence of input validation in praisonaiagents/tools/web_crawl_tools.py web_crawl() function. CWE-918 server-side request forgery occurs when agent-supplied URLs bypass all security controls: no URI scheme validation, no RFC1918 private IP filtering, no localhost/metadata endpoint blocklist. Attack vector includes prompt injection in previously crawled content triggering recursive SSRF chains.
Know when Praisonaiagents gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128.
Executive ViewAI
CVE-2026-40150 affects PraisonAIAgents versions below 1.5.128 and enables authenticated users to conduct server-side request forgery attacks through the web_crawl() function, potentially exposing cloud credentials, internal services, and sensitive data. Organizations using PraisonAIAgents in production must immediately restrict agent access and review deployment configurations, as any authenticated user-including lower-privileged accounts-can weaponize AI agent functions to exfiltrate infrastructure secrets.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network egress from PraisonAIAgents processes using firewall rules or container network policies to block RFC 1918 private ranges and 169.254.0.0/16; (2) Implement URL validation at application logic layer to allowlist only required external domains; (3) Disable web_crawl() functionality if not operationally critical; (4) Enforce strict authentication and authorization controls limiting agent invocation to trusted roles only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59,
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbit
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Exploit-DB