EUVD-2026-21158
GHSA-8frj-8q3m-xhgm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When a submitted job completes (success or failure), the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server send POST requests to arbitrary internal or external destinations, enabling SSRF against cloud metadata services, internal APIs, and other network-adjacent services. This vulnerability is fixed in 4.5.128.
AnalysisAI
Server-Side Request Forgery in PraisonAI versions prior to 4.5.128 allows unauthenticated remote attackers to force the server to send HTTP POST requests to arbitrary internal or external destinations via an unvalidated webhook_url parameter in the /api/v1/runs endpoint. Attackers can abuse this to access cloud metadata services (AWS/GCP/Azure instance metadata), internal APIs, and network-adjacent services, potentially exposing credentials, configuration data, or triggering unauthorized actions. No public exploit identified at time of analysis. CVSS 7.2 indicates changed scope with low confidentiality and integrity impact.
Technical ContextAI
CWE-918 SSRF via webhook_url parameter accepted without validation. Vulnerable httpx.AsyncClient POST implementation triggers on job completion callbacks, enabling blind SSRF. Lack of URL allowlisting/blocklisting permits internal network enumeration (RFC 1918 addresses, 169.254.169.254 metadata endpoints) and external exfiltration channels. Changed scope (S:C) reflects cross-tenant risk in multi-user deployments.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later immediately. This release implements URL validation on the /api/v1/runs webhook_url parameter to prevent SSRF. Until upgrade is completed, implement network-level egress filtering to block server outbound connections to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and localhost (127.0.0.0/8). Deploy Web Application Firewall rules to reject requests containing suspicious webhook_url values. Review application logs for unauthorized callback attempts to internal endpoints. For full details, see GitHub Security Advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8frj-8q3m-xhgm
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today