CVE-2026-44335: Praison Praisonaiagents SSRF Vulnerability

CVE-2026-44335 Overview

CVE-2026-44335 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. The flaw exists in the URL checking logic, which contains a logical defect that attackers can bypass to coerce the server into issuing unintended outbound requests. All versions prior to 1.6.32 are affected. The issue is tracked under CWE-918 and was patched in release 1.6.32.

Critical Impact

Successful exploitation enables unauthenticated attackers over the network to make the PraisonAI agent reach internal services, cloud metadata endpoints, or other restricted resources, compromising integrity of agent-driven workflows.

Affected Products

• praison:praisonaiagents Python package, all versions prior to 1.6.32
• PraisonAI multi-agent deployments using the vulnerable URL validation logic
• Downstream applications embedding praisonaiagents for autonomous agent orchestration

Discovery Timeline

• 2026-05-08 - CVE-2026-44335 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-44335

Vulnerability Analysis

PraisonAI orchestrates multi-agent workflows where agents fetch remote content as part of tool execution. The package implements URL validation logic intended to prevent agents from contacting unauthorized destinations. The validation routine contains a logic flaw, allowing crafted URLs to evade the allow/deny decision and reach arbitrary hosts.

An attacker who can influence a URL parameter consumed by an agent can direct outbound HTTP requests to internal-only services. Typical SSRF targets include cloud instance metadata services, internal administrative endpoints, container orchestration APIs, and lateral services bound to loopback interfaces. The CVSS 4.0 vector indicates impact concentrated on integrity rather than confidentiality of the vulnerable system, reflecting the request-forging nature of SSRF.

Root Cause

The root cause is improper URL validation logic in praisonaiagents. Common patterns behind this class of SSRF include hostname parsing inconsistencies between validator and HTTP client, failure to re-resolve DNS after validation, missing handling of URL schemes such as file:// or gopher://, and inadequate filtering of redirect targets. The advisory confirms the defect is logical rather than configuration-related and was corrected by tightening the check in version 1.6.32.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker submits a malicious URL through any interface that ultimately feeds a URL into the validated fetch path - prompt input, tool arguments, agent task descriptions, or API parameters. Because validation logic accepts the crafted URL, the agent issues the outbound request on the attacker's behalf. See the GitHub Security Advisory GHSA-q9pw-vmhh-384g for vendor details.

Detection Methods for CVE-2026-44335

Indicators of Compromise

• Outbound HTTP requests from PraisonAI hosts to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.169.254 metadata endpoints.
• Agent logs containing fetched URLs that do not match expected business destinations.
• Unexpected use of non-HTTP schemes such as file://, gopher://, or dict:// in agent request traces.

Detection Strategies

• Inspect application logs for URL fetch operations originating from praisonaiagents and correlate destination hosts against an approved allowlist.
• Monitor egress traffic from agent workloads for connections to RFC1918 ranges, cloud metadata services, and Kubernetes API endpoints.
• Alert on PraisonAI processes running versions earlier than 1.6.32 via software inventory queries.

Monitoring Recommendations

• Enable verbose request logging in agent tool wrappers and ship logs to a centralized analytics platform for correlation.
• Baseline normal agent egress destinations and trigger alerts on deviations, especially internal subnets.
• Track installed versions of praisonaiagents continuously and flag any host below 1.6.32.

How to Mitigate CVE-2026-44335

Immediate Actions Required

• Upgrade praisonaiagents to version 1.6.32 or later across all environments.
• Audit recent agent activity logs for outbound requests to internal or metadata endpoints.
• Rotate any credentials, tokens, or cloud instance metadata-derived secrets that may have been exposed via SSRF.

Patch Information

The maintainers fixed the URL validation logic in PraisonAI 1.6.32. Upgrade using pip install --upgrade praisonaiagents==1.6.32. Refer to the GitHub Security Advisory GHSA-q9pw-vmhh-384g for the authoritative patch reference.

Workarounds

• Place PraisonAI workloads behind an egress proxy that enforces a strict destination allowlist.
• Block agent network access to cloud metadata IPs such as 169.254.169.254 using host firewalls or network policies.
• Run agents in network-segmented namespaces without route access to internal management planes.

# Configuration example: upgrade and verify the patched version
pip install --upgrade 'praisonaiagents>=1.6.32'
python -c "import praisonaiagents; print(praisonaiagents.__version__)"