EUVD-2026-21513
GHSA-qq9r-63f6-v542
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick LLM agent into crawling internal URL
-
Deliveryhttpx fallback processes URL without validation
-
ExploitRequest reaches metadata endpoint or internal service
-
ExecutionResponse returned to agent output
-
ImpactAttacker reads sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires PraisonAIAgents versions prior to 1.5.128 with default configuration (no Tavily API key configured, Crawl4AI not installed). Attacker must trick an LLM agent into crawling a crafted internal URL via prompt injection or social engineering. The agent's response containing metadata or internal service data must be visible to attacker. |
| Impact | CVSS 7.1 reflects high confidentiality impact via SSRF to metadata endpoints and internal services. Unauthenticated attacker with UI interaction (user prompt injection) can extract cloud credentials or internal data. Default vulnerable configuration (no Tavily/Crawl4AI) increases blast radius. Moderate observed exploitation activity. Organizations running PraisonAI <1.5.128 should prioritize patching immediately. |
| Exploit ScenarioDerived | Attacker crafts prompt directing LLM agent to crawl http://169.254.169.254/latest/meta-data/iam/security-credentials/. Agent uses httpx fallback (default path), follows redirects without validation, returns metadata response to agent output visible to attacker. Credentials or internal service responses exposed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to manipulate LLM agents into crawling arbitrary internal URLs. The httpx fallback crawler accepts user-supplied URLs without host validation and follows redirects, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and localhost. Response content is returned to the agent and may be exposed in attacker-visible output. This vulnerability is the default behavior on fresh installations without Tavily API keys or Crawl4AI dependencies. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to PraisonAIAgents version 1.5.128 immediately. This release implements host validation and restricts internal network access in the httpx fallback crawler. Until patching, disable the web_crawl function entirely or enforce strict allowlists for crawlable domains at the application layer. Consider deploying network egress controls to block agent access to RFC 1918 private ranges and cloud metadata endpoints (169.254.169.254/32). Review agent output logs for evidence of internal URL crawling attempts. Full vendor advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542. Organizations using LLM agents with external input should implement defense-in-depth controls including prompt injection detection and network segmentation to limit blast radius of SSRF exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-918 implementation in web_crawl's httpx.AsyncClient.get() fallback path. User-controlled URLs pass directly to the HTTP client with follow_redirects=True and no allowlist validation. The absence of host checking enables LLM prompt injection attacks to trigger internal network reconnaissance via the agent's HTTP capabilities, bypassing standard network perimeter controls.
Know when Praisonaiagents gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
Executive ViewAI
PraisonAIAgents versions before 1.5.128 contain an unauthenticated Server-Side Request Forgery vulnerability that allows attackers to redirect the application into crawling internal systems, cloud metadata endpoints, and localhost services-exposing sensitive infrastructure data through LLM agent responses. Organizations using PraisonAI for any customer-facing or production workload risk unauthorized access to cloud credentials, internal service information, and system configuration details.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the httpx fallback crawler by configuring valid Tavily API keys in all environments; (2) Deploy Crawl4AI as a validated URL fetching dependency to replace the vulnerable fallback; (3) Implement egress filtering at network layer to block 169.254.169.254/32 and restrict internal IP ranges; (4) Isolate PraisonAI processes in network segments without access to cloud metadata services or sensitive internal hosts; (5) Monitor agent logs for URL patterns targeting internal or metadata endpoints and alert on suspicious requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Related Vulnerabilities in PraisonAI Multiple Code Execution and Path Traversal
View all 5More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59,
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbit
Unauthenticated remote agent enumeration and invocation in PraisonAI's AgentTeam.launch() / Agents.launch() HTTP server
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Exploit-DB