CVE-2026-47390: PraisonAI SSRF Protection Bypass Flaw

CVE-2026-47390 Overview

CVE-2026-47390 is a Server-Side Request Forgery (SSRF) protection bypass in PraisonAI, a multi-agent teams system. The vulnerability affects PraisonAI versions prior to 4.6.40 and praisonaiagents versions prior to 1.6.40. The spider_tools module implements a URL validation function intended to block requests to local or unsafe targets. However, the validation only rejects a small set of exact host strings such as localhost and 127.0.0.1. Attackers who can influence URLs passed to scrape_page, crawl, or extract_text can bypass the check using alternate loopback host encodings and reach internal services.

Critical Impact
Attackers can bypass URL validation and issue SSRF requests to loopback-only services, exposing internal endpoints not intended for external access.

Affected Products

PraisonAI versions prior to 4.6.40
praisonaiagents versions prior to 1.6.40
Deployments exposing spider_tools functions (scrape_page, crawl, extract_text) to untrusted input

Discovery Timeline

2026-07-21 - CVE-2026-47390 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47390

Vulnerability Analysis

The flaw resides in the URL validation logic of spider_tools within praisonaiagents. The validator compares the supplied host against a static deny list containing only exact strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse alternate IPv4 representations, or verify the final resolved IP before performing the HTTP request. Once the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-supplied URL. This maps to [CWE-918: Server-Side Request Forgery].

Root Cause

The root cause is incomplete input validation. The check relies on exact string matching against a limited deny list rather than resolving the target and validating the final IP address. Loopback and internal networks can be reached using decimal IPv4 integers, hexadecimal notation, zero-prefixed octets, IPv6 loopback [::1], or alternate hostnames that resolve to 127.0.0.0/8. None of these forms are normalized before the request is issued.

Attack Vector

An attacker who controls or influences URLs passed to scrape_page, crawl, or extract_text supplies a crafted URL pointing to a loopback address in a non-canonical form. The validator returns success, and the tool performs an HTTP GET against the internal target using the session client. This exposes services bound to loopback interfaces, including metadata endpoints, administrative APIs, and other host-local components.

python

# Patch excerpt: src/praisonai-agents/praisonaiagents/tools/spider_tools.py
import logging
import ipaddress
import socket
from typing import List, Dict, Union, Optional, Any
from importlib import util
import json
# Source: https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6

python

# Patch excerpt: src/praisonai-agents/praisonaiagents/tools/mentions.py
def _process_url_mention(self, url: str) -> Optional[str]:
    """Process @url:https://... mention."""
    try:
        from praisonaiagents.tools.spider_tools import SpiderTools

        if not SpiderTools()._validate_url(url):
            return f"# URL: {url}\n[Blocked: URL is not allowed]"

        import urllib.request

        req = urllib.request.Request(
# Source: https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6

The patched code imports ipaddress and socket to resolve hostnames and validate the final IP before making outbound requests. The mentions.py change routes URL processing through the hardened SpiderTools()._validate_url() gate.

Detection Methods for CVE-2026-47390

Indicators of Compromise

Outbound HTTP requests from PraisonAI worker processes targeting loopback addresses in non-canonical forms such as 127.1, 2130706433, 0x7f000001, or [::1].
Access log entries on locally bound services showing requests originating from the PraisonAI process user.
Agent inputs containing URLs referencing internal hostnames, cloud metadata endpoints, or RFC1918 ranges.

Detection Strategies

Inspect application logs for calls to scrape_page, crawl, and extract_text and correlate the target URLs against a normalized IP deny list.
Monitor process-level network telemetry for connections from the PraisonAI runtime to 127.0.0.0/8, 169.254.169.254, or RFC1918 addresses.
Alert on prompts or agent inputs that embed @url: mentions resolving to internal networks.

Monitoring Recommendations

Enable egress logging on the host running PraisonAI and forward records to a SIEM for correlation.
Track version metadata of the praisonaiagents package across environments to identify unpatched deployments.
Baseline expected outbound destinations for agent tools and alert on deviations.

How to Mitigate CVE-2026-47390

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later and praisonaiagents to version 1.6.40 or later.
Audit any custom tooling that reuses spider_tools validation to confirm it inherits the patched _validate_url logic.
Restrict which agents and users can supply URLs to scrape_page, crawl, and extract_text.

Patch Information

A fix is available in PraisonAI 4.6.40 and praisonaiagents 1.6.40. See the GitHub Security Advisory GHSA-5c6w-wwfq-7qqm, the GitHub Pull Request #1684, and the GitHub Commit Changes for the code changes.

Workarounds

Deploy PraisonAI in a network namespace or container that has no route to loopback services or cloud metadata endpoints.
Enforce an egress proxy that blocks requests to 127.0.0.0/8, 169.254.0.0/16, and RFC1918 ranges from the PraisonAI process.
Wrap scrape_page, crawl, and extract_text in a caller-side validator that resolves DNS and rejects non-public destinations before invocation.

bash

# Upgrade to patched versions
pip install --upgrade 'praisonaiagents>=1.6.40'
pip install --upgrade 'PraisonAI>=4.6.40'