EUVD-2026-42896
GHSA-3wrm-pm5v-8vq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, no auth required per CVSS 4.0 confirmation; scope changed as internal services beyond the app boundary are reachable; blind SSRF caps C/I at Low; no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.
AnalysisAI
Unauthenticated blind SSRF via DNS rebinding in PraisonAI before 4.6.78 allows remote attackers to reach internal services through the Jobs API /api/v1/runs endpoint without credentials. The webhook_url parameter is validated at request intake but re-resolved at connection time, creating a TOCTOU window exploitable by an attacker who controls a malicious DNS server - flipping the resolved IP from a legitimate external address to an internal target after validation passes. No public exploit code or CISA KEV listing exists at time of analysis; the unauthenticated network vector (AV:N/PR:N) makes this a meaningful risk for any internet-exposed PraisonAI deployment, particularly in cloud environments where internal metadata APIs may be reachable.
Technical ContextAI
PraisonAI is an AI agent orchestration framework (CPE: cpe:2.3:a:mervinpraison:praisonai). Its Jobs API exposes a /api/v1/runs endpoint that accepts a webhook_url parameter for callback notifications. The root cause is CWE-918 (Server-Side Request Forgery), specifically a Time-of-Check/Time-of-Use (TOCTOU) variant: the application validates the supplied URL at request intake but independently re-resolves the hostname at the moment of connection, without re-validating the resolved IP. DNS rebinding exploits this gap - an attacker who controls a DNS server initially serves a legitimate external IP (satisfying the allow-list check), then switches the DNS record - typically via a very low TTL - to an internal RFC1918 or loopback address before PraisonAI makes its outbound HTTP call. The server then connects to the internal target on the attacker's behalf. Because the response is not surfaced back to the attacker, the SSRF is classified as blind, limiting direct data exfiltration while still permitting internal service enumeration via timing side-channels and triggering state-changing operations on internal APIs.
RemediationAI
Upgrade PraisonAI to version 4.6.78 or later, which resolves the TOCTOU re-resolution flaw per the vendor security advisory GHSA-4w49-gwv8-fpjg (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg). If immediate upgrade is not feasible, apply network-level egress filtering on the PraisonAI server host to block outbound connections to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16); note this limits blast radius but does not eliminate the TOCTOU flaw and may break legitimate internal webhook use cases. Additionally, restricting access to the /api/v1/runs endpoint via a reverse proxy or WAF to authenticated or internal-only callers eliminates the unauthenticated attack surface at the cost of breaking external webhook consumers. Both workarounds should be treated as temporary mitigations pending patch deployment.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today