PraisonAI CVE-2026-55523

Exploitation requires that the attacker can influence a URL processed by web_crawl(), either directly through an API or user-facing input that invokes the function, or indirectly via an agent or tool workflow that incorporates attacker-controlled strings into fetched URLs. The attacker must also control a publicly accessible HTTP endpoint capable of issuing a 3xx redirect to the desired internal target. No non-default configuration is required - follow_redirects=True is the default httpx fallback behavior. Exploitation is limited to reading HTTP responses from services reachable from the PraisonAI host's network interface; targets that require mutual TLS, host-based authentication, or are unreachable from the host's network cannot be reached. Deployments not hosted in cloud environments lack the cloud metadata attack path but remain vulnerable to SSRF against any other internal HTTP service reachable from the host.

The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N, score 7.7) accurately characterizes the attack model: network-reachable, low complexity, no authentication required, with high confidentiality impact on subsequent systems (internal services and cloud infrastructure) rather than on the PraisonAI process itself. The SC:H designation is consistent with the most severe realistic outcome - exfiltration of cloud IAM credentials from instance metadata endpoints, which can lead to full cloud account compromise. Real-world risk is substantially elevated in cloud-hosted deployments (AWS, GCP, Azure) where instance metadata services are reachable by default. The patch-bypass nature of this CVE increases urgency relative to a first-disclosure SSRF, as operators who applied the prior fix (CVE-2026-40160) may incorrectly believe they are protected. No CISA KEV listing has been identified and no EPSS score is available in the provided intelligence, so exploitation probability cannot be quantified from these signals alone; however, the SSRF-via-redirect technique is well-understood and the target (cloud metadata) is high-value, making opportunistic exploitation plausible for motivated actors. The primary limiting factor is that exploitation requires influencing a URL passed to an agent workflow, which narrows the attack surface compared to a generic unauthenticated web endpoint.

An attacker interacting with a PraisonAI agent that accepts user-supplied URLs - for example, a research or scraping agent - submits a URL pointing to an attacker-controlled public server. That server responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole, and because the httpx client follows the redirect without revalidating the destination host, the cloud instance's IAM role credentials are fetched and returned in the web_crawl() response body, potentially surfacing in agent output, logs, or downstream tool results. No public proof-of-concept code has been identified, but the technique requires only a basic redirect server and is well-documented in public SSRF research.