EUVD-2026-44639
GHSA-92x2-g374-gcvx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable tool requiring low-privilege access (PR:L); SSRF crosses into internal services so scope changes (S:C); high read of internal data (C:H) with limited integrity (I:L) and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.
AnalysisAI
Server-side request forgery in PraisonAI's web_crawl tool (versions before 1.6.78) allows an authenticated attacker to reach internal HTTP services and exfiltrate their response bodies. The flaw stems from a time-of-check/time-of-use gap: hostnames are validated once but re-resolved at connection time without IP pinning, so DNS rebinding defeats the SSRF allowlist. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technique is well-documented and the vendor has released a fix in 1.6.78.
Technical ContextAI
PraisonAI is an open-source multi-agent LLM framework (Python package 'praisonai', vendor mervinpraison) that exposes tool-calling capabilities to AI agents, including a web_crawl tool that fetches arbitrary URLs. The vulnerability is a classic CWE-918 (SSRF) rooted in a TOCTOU DNS resolution bug: the SSRF guard resolves the target hostname and checks the resulting IP against a block/allow policy, but the underlying HTTP client independently re-resolves the same hostname when it opens the socket. Because the resolved IP is never pinned between the check and the connect, an attacker who controls the authoritative DNS for a hostname can return a public IP during validation and a private/loopback IP (e.g. 127.0.0.1, 169.254.169.254, 10.0.0.0/8) at connect time - the DNS rebinding pattern - causing the crawler to fetch from and return internal service content.
RemediationAI
Vendor-released patch: upgrade PraisonAI to 1.6.78 or later, which is the primary and confirmed fix (see GHSA-qg25-6gc4-48mg). If immediate upgrade is not possible, the effective compensating control is to eliminate the DNS-rebinding window: disable the web_crawl tool entirely for exposed agents (trade-off: agents lose live web-fetch capability), or place the crawler behind an egress proxy/firewall that denies traffic to RFC1918, loopback, and link-local ranges (169.254.169.254 metadata endpoint) at the network layer so a rebind to an internal IP is blocked regardless of application-level checks (trade-off: requires egress-filtering infrastructure and can break legitimate internal crawling use cases). Additionally, restrict who can invoke the tool by tightening the authentication/authorization on the PraisonAI interface, since exploitation requires PR:L. Consult the vendor advisory (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg) for the authoritative fix.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today