CVE-2026-55524: PraisonAI SSRF Vulnerability

CVE-2026-55524 Overview

CVE-2026-55524 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system. The web_crawl tool validates the initially supplied URL against private, loopback, and link-local addresses, but the fetcher re-resolves the hostname at connect time and follows redirects. This validate-here/fetch-there gap [CWE-367] allows attackers to reach internal services and cloud metadata endpoints from the PraisonAI host. Affected releases include all versions prior to 1.6.58.

Critical Impact
Attackers who influence URLs passed to web_crawl() can exfiltrate cloud metadata credentials, probe internal networks, and read loopback services, with response bodies returned directly in tool output.

Affected Products

PraisonAI versions prior to 1.6.58
Deployments using the web_crawl tool with httpx.Client
Deployments falling back to urllib.request.urlopen when httpx is absent

Discovery Timeline

2026-08-05 - CVE-2026-55524 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-55524

Vulnerability Analysis

The web_crawl tool in PraisonAI enforces SSRF protection only during initial input validation. It resolves the supplied hostname once using socket.gethostbyname and rejects private, loopback, or link-local results. After this check passes, the URL is handed to a fetcher that reopens the connection independently. The fetcher re-resolves DNS at connect time and follows HTTP redirects without applying the same validation. This creates a classic time-of-check to time-of-use (TOCTOU) window between validation and fetch.

The response body from the internal destination is returned to the caller in the web_crawl() result. Attackers therefore receive the retrieved content directly, turning the tool into a full-read SSRF primitive rather than a blind one.

Root Cause

The root cause is duplicate DNS resolution across trust boundaries. The security check operates on one resolved address, while the actual network connection uses a fresh resolution. The fetcher is configured with httpx.Client(follow_redirects=True), and the urllib fallback also follows redirects. Neither path revalidates intermediate or final hosts.

Attack Vector

Attackers exploit the gap through two techniques. First, they supply a public URL that returns an HTTP redirect (301/302) to an internal target such as http://169.254.169.254/latest/meta-data/. Second, they use DNS rebinding, where the attacker-controlled domain answers the validation query with a public IP and the fetch query with an internal IP. Either path causes the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints and return their contents.

See the GitHub Security Advisory GHSA-vg6p-v9vm-6fgj for full technical details.

Detection Methods for CVE-2026-55524

Indicators of Compromise

Outbound requests from the PraisonAI host to 169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16
DNS queries where the same hostname resolves to differing addresses within seconds, indicating DNS rebinding
HTTP redirect chains in web_crawl logs terminating at RFC1918 or link-local destinations
Unexpected access to cloud instance metadata service (IMDS) tokens or IAM credentials

Detection Strategies

Inspect application logs for web_crawl() invocations whose final fetched URL differs from the input URL
Alert on any process associated with PraisonAI initiating connections to metadata IPs or internal CIDR ranges
Compare DNS resolution results at validation time versus connect time for hosts queried by the agent

Monitoring Recommendations

Enable egress logging on the PraisonAI host and forward to a centralized SIEM with OCSF-normalized network telemetry
Monitor for anomalous HTTP 3xx redirect patterns in outbound traffic originating from agent workloads
Track process-to-network correlations tying the Python interpreter running PraisonAI to internal service endpoints

How to Mitigate CVE-2026-55524

Immediate Actions Required

Upgrade PraisonAI to version 1.6.58 or later immediately
Enforce IMDSv2 on AWS instances to require session tokens for metadata access
Restrict egress from PraisonAI hosts to an allowlist of required external destinations
Audit historical web_crawl logs for redirects to internal or metadata endpoints

Patch Information

The issue is fixed in PraisonAI 1.6.58. Update the package using pip install --upgrade praisonai and confirm the installed version with pip show praisonai. Full remediation notes are available in the GitHub Security Advisory.

Workarounds

Disable the web_crawl tool in agent configurations until patching is complete
Deploy a forward proxy that blocks requests to RFC1918, loopback, and link-local ranges, and route all agent traffic through it
Disable HTTP redirect following in any custom fetcher wrappers by setting follow_redirects=False
Place PraisonAI hosts on network segments without access to internal management interfaces or cloud metadata services

bash

# Upgrade to the patched release
pip install --upgrade 'praisonai>=1.6.58'
pip show praisonai | grep -i version