EUVD-2026-53606
GHSA-vg6p-v9vm-6fgj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
AV:N and PR:N because influence over web_crawl() URLs can be achieved without credentials; AC:H because DNS rebinding or redirect infrastructure is required; S:C and C:H reflect cloud-metadata credential access beyond the vulnerable component.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.
AnalysisAI
Server-Side Request Forgery (SSRF) bypass in PraisonAI's web_crawl tool prior to version 1.6.58 enables unauthenticated network attackers to reach internal network resources, loopback interfaces, and cloud metadata endpoints (such as AWS IMDS) from the PraisonAI host. The protection bypass exploits a validate-here/fetch-there gap (CWE-367 TOCTOU): the hostname is validated once with socket.gethostbyname but then re-resolved at connect time by httpx or urllib with redirect-following enabled, allowing HTTP redirect chains or DNS rebinding to steer the final connection to attacker-chosen internal destinations. No public exploit code or active exploitation has been identified at time of analysis; a fix is available in version 1.6.58.
Technical ContextAI
PraisonAI is a Python-based multi-agent AI orchestration framework. Its web_crawl tool is intended to retrieve external web content for agent workflows. The SSRF mitigation calls socket.gethostbyname once and rejects RFC1918, loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses. However, the validated URL is then passed to httpx.Client(follow_redirects=True), or to urllib.request.urlopen as a fallback, both of which perform an independent DNS resolution at TCP connect time with no subsequent IP validation. CWE-367 (Time-of-check Time-of-use Race Condition) precisely describes this class of defect: the security-relevant property (destination IP) is checked at one moment and consumed at another, and an attacker can alter the mapping between those two points. Exploitation paths include (1) HTTP redirect: attacker controls a public server that returns a 3xx redirect to an internal address after the check completes, and (2) DNS rebinding: attacker's DNS server returns a public IP for the initial resolution but switches to 127.0.0.1 or a cloud-metadata IP (169.254.169.254) on subsequent lookups, exploiting TTL expiry between the check and the fetch.
RemediationAI
Upgrade PraisonAI to version 1.6.58 or later, which resolves the validate-here/fetch-there gap. See the vendor security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj for release details. If immediate upgrade is not possible, restrict the network egress of the PraisonAI host using firewall or security-group rules to deny outbound connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) including the cloud metadata endpoint 169.254.169.254; this does not fix the code flaw but breaks the reachability precondition. Note that egress filtering alone does not protect against rebinding to other internal hosts reachable via routing if rules are not comprehensive. Additionally, enabling AWS IMDSv2 (token-required mode) on EC2 instances hosting PraisonAI blocks metadata retrieval via simple GET requests, reducing the worst-case credential-theft impact. Avoid exposing the web_crawl tool to untrusted URL input sources in agent workflows until the patch is applied.
Share
External POC / Exploit Code
Leaving vuln.today