Which versions of Praisonai are affected by CVE-2026-61429?

PraisonAI's Crawl4AI web crawler (versions before 1.6.78) contains a high-severity SSRF vulnerability that bypasses URL security controls, allowing attackers to access sensitive internal systems and…. A patch is available.

How to fix or mitigate CVE-2026-61429?

Within 24 hours: Audit all systems running Crawl4AI versions before 1.6.78 and restrict network access from these systems to internal services. Within 7 days: Implement network-level controls including DNS filtering to prevent rebinding attacks, enforce strict URL allowlists at the firewall level, and isolate Crawl4AI instances on restricted network segments. Within 30 days: Establish patch availability timeline with PraisonAI, review system logs for signs of exploitation, and evaluate migration to alternative crawling solutions with hardened SSRF protections.

Praisonai CVE-2026-61429

Q: What is the CVSS score of CVE-2026-61429?

CVE-2026-61429 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43178 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-11 VulnCheck

GHSA-rc3q-9pxg-3jhr

Google SSRF Praisonai Mervinpraison

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 14:00 vuln.today

DescriptionCVE.org

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.

AnalysisAI

Server-side request forgery in PraisonAI's Crawl4AI/Chromium crawling backend (all versions before 1.6.78) lets low-privileged users bypass URL allowlist/SSRF validation through DNS rebinding and HTTP redirects, causing the headless browser to reach internal-only services and return their responses. Because validation happens before the browser dereferences the URL, an attacker-controlled host can pass the check and then resolve or redirect to internal endpoints, exposing sensitive internal data (demonstrated with canary values). Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.