Which versions of Praisonaiagents are affected by EUVD-2026-21513?

PraisonAIAgents versions before 1.5.128 contain an unauthenticated Server-Side Request Forgery vulnerability that allows attackers to redirect the application into crawling internal systems, cloud…. A patch is available.

How to fix or mitigate EUVD-2026-21513?

Within 24 hours: Inventory all PraisonAIAgents deployments and confirm current version (check requirements.txt or pip show praisonaiagents). Within 7 days: Upgrade all instances to version 1.5.128 or later; confirm Tavily API keys are configured in production to disable fallback crawlers, or deploy Crawl4AI as a validated alternative. Within 30 days: Implement network segmentation to restrict outbound HTTP/HTTPS from PraisonAI processes, add WAF/proxy rules to block requests to 169.254.169.254 and internal RFC1918 ranges, and conduct log review for suspicious URL patterns in agent inputs.

Praisonaiagents EUVD-2026-21513

Q: What is the CVSS score of EUVD-2026-21513?

EUVD-2026-21513 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40160 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-10 GitHub_M

GHSA-qq9r-63f6-v542

SSRF Praisonaiagents

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 20:22 vuln.today

cvss_changed

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 17:15 euvd

EUVD-2026-21513

Analysis Generated

Apr 10, 2026 - 17:15 vuln.today

CVE Published

Apr 10, 2026 - 16:59 nvd

HIGH 7.1

DescriptionGitHub Advisory

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.

AnalysisAI

Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to manipulate LLM agents into crawling arbitrary internal URLs. The httpx fallback crawler accepts user-supplied URLs without host validation and follows redirects, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and localhost. Response content is returned to the agent and may be exposed in attacker-visible output. This vulnerability is the default behavior on fresh installations without Tavily API keys or Crawl4AI dependencies. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-918 implementation in web_crawl's httpx.AsyncClient.get() fallback path. User-controlled URLs pass directly to the HTTP client with follow_redirects=True and no allowlist validation. The absence of host checking enables LLM prompt injection attacks to trigger internal network reconnaissance via the agent's HTTP capabilities, bypassing standard network perimeter controls.

RemediationAI

Vendor-released patch: upgrade to PraisonAIAgents version 1.5.128 immediately. This release implements host validation and restricts internal network access in the httpx fallback crawler. Until patching, disable the web_crawl function entirely or enforce strict allowlists for crawlable domains at the application layer. Consider deploying network egress controls to block agent access to RFC 1918 private ranges and cloud metadata endpoints (169.254.169.254/32). Review agent output logs for evidence of internal URL crawling attempts. Full vendor advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542. Organizations using LLM agents with external input should implement defense-in-depth controls including prompt injection detection and network segmentation to limit blast radius of SSRF exploitation.