CVE-2026-55523 Overview
CVE-2026-55523 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in PraisonAI, a multi-agent teams system. The flaw affects the praisonaiagents.tools.web_crawl_tools.web_crawl() function in versions 1.5.128 through 1.6.57. The initial URL host check validates only the requested URL, not the final destination after HTTP redirects. Attackers can supply a public URL that redirects to loopback, private-network, or cloud metadata endpoints. The redirected response body is returned in the web_crawl() result. This issue is fixed in version 1.6.58.
Critical Impact
An attacker who can influence a URL passed to web_crawl() can reach internal services and cloud metadata endpoints, exposing sensitive infrastructure data to the caller.
Affected Products
- PraisonAI versions 1.5.128 through 1.6.57
- praisonaiagents.tools.web_crawl_tools.web_crawl() function
- Deployments using the default httpx fallback client
Discovery Timeline
- 2026-08-05 - CVE-2026-55523 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-55523
Vulnerability Analysis
The web_crawl() function performs a host allowlist check against the initially supplied URL, blocking direct requests to loopback and private network addresses. The default httpx fallback client is instantiated with httpx.Client(follow_redirects=True). This configuration causes the client to transparently follow HTTP 3xx responses to arbitrary locations without revalidating the destination. The guard executes once, on the caller-supplied URL, and never inspects intermediate or final redirect targets. This is an incomplete fix and patch bypass of the earlier SSRF class tracked as GHSA-qq9r-63f6-v542 / CVE-2026-40160 and GHSA-8f4v-xfm9-3244.
Root Cause
The root cause is validation performed only on the requested URL rather than on the actual destination fetched after redirection. The redirect handler in httpx does not consult the host allowlist. As a result, blocklist enforcement is bypassed whenever an attacker-controlled server issues a redirect.
Attack Vector
An attacker who can influence any URL passed to web_crawl(), directly or through an agent or tool workflow, hosts a public endpoint that responds with an HTTP redirect. The redirect target points to internal services such as http://127.0.0.1, RFC1918 addresses, or cloud metadata endpoints like http://169.254.169.254/latest/meta-data/. The initial host check passes because the requested hostname is public. The httpx client then follows the redirect and returns the internal response body to the caller. Prompt injection into an LLM agent is a plausible delivery mechanism when the agent accepts untrusted content that later drives tool invocation.
See the GitHub Security Advisory GHSA-8hjw-25cg-g52h for full technical details.
Detection Methods for CVE-2026-55523
Indicators of Compromise
- Outbound HTTP requests from PraisonAI hosts to public URLs immediately followed by inbound-style requests to loopback or link-local addresses within the process.
- Access attempts to cloud metadata endpoints such as 169.254.169.254 (AWS/Azure/GCP) or metadata.google.internal originating from agent workloads.
- web_crawl() result payloads containing IAM credentials, instance identity documents, or internal service banners.
Detection Strategies
- Inventory PraisonAI installations and flag any deployment running praisonaiagents between versions 1.5.128 and 1.6.57.
- Instrument the httpx client with logging or tracing to record the full redirect chain and final resolved host for each web_crawl() invocation.
- Alert on HTTP 3xx responses that resolve to RFC1918, loopback, or link-local ranges when initiated by agent tool calls.
Monitoring Recommendations
- Enable egress logging on hosts running PraisonAI agents and correlate outbound requests with subsequent internal metadata endpoint access.
- Monitor cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) for anomalous IMDS token requests from agent workload identities.
- Track LLM prompt and tool-invocation logs for URLs supplied by untrusted content that are later passed to web_crawl().
How to Mitigate CVE-2026-55523
Immediate Actions Required
- Upgrade PraisonAI to version 1.6.58 or later, which revalidates redirect destinations against the host allowlist.
- Enforce IMDSv2 with hop-limit 1 on AWS EC2 instances hosting PraisonAI agents to blunt metadata exfiltration.
- Restrict egress from agent workloads using network policies, service mesh rules, or outbound proxies that block RFC1918 and link-local ranges.
Patch Information
The vulnerability is fixed in PraisonAI version 1.6.58. The maintainer's advisory is published at GHSA-8hjw-25cg-g52h. The fix ensures that the host allowlist is applied to the actual destination fetched after any redirect chain, rather than only to the initially requested URL.
Workarounds
- Disable redirect following by configuring the underlying httpx client with follow_redirects=False where the deployment permits customization.
- Route all agent HTTP traffic through an egress proxy that enforces destination allowlisting and rejects private-range targets.
- Sanitize or restrict URLs reaching web_crawl() from untrusted agent inputs and tool workflows until the upgrade is applied.
# Configuration example
pip install --upgrade 'praisonaiagents>=1.6.58'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
