CVE-2026-55525: PraisonAI SSRF Vulnerability

CVE-2026-55525 Overview

CVE-2026-55525 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system. Versions of praisonaiagents prior to 1.6.58 validate only the initial URL supplied to the web_crawl function. The downstream _crawl_with_httpx helper then instantiates httpx.Client(follow_redirects=True) without revalidating redirect targets. An attacker who influences a crawl target can point a public URL at loopback interfaces, private network ranges, or cloud metadata services. The fetched internal response is returned to the agent context, exposing sensitive infrastructure data even when ALLOW_LOCAL_CRAWL is disabled. The issue is fixed in version 1.6.58.

Critical Impact
Attackers can bypass SSRF controls to reach cloud metadata endpoints and internal services, extracting credentials and sensitive network data through the agent runtime.

Affected Products

PraisonAI praisonaiagents versions prior to 1.6.58
web_crawl function within the praisonaiagents package
Deployments using the _crawl_with_httpx HTTP client helper

Discovery Timeline

2026-08-25 - CVE-2026-55525 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55525

Vulnerability Analysis

The flaw is classified as [CWE-918] Server-Side Request Forgery. The web_crawl function accepts a URL and applies validation to reject loopback and private-range targets when ALLOW_LOCAL_CRAWL is disabled. That check runs once against the initial URL. Control then passes to _crawl_with_httpx, which constructs an httpx.Client with follow_redirects=True. HTTP 3xx responses from the initial host are followed transparently, and the redirected request is issued without repeating the safety validation.

An attacker who controls or influences a crawl target hosts a public endpoint that responds with a redirect to http://169.254.169.254/, http://127.0.0.1/, or an RFC1918 address. The client fetches the internal resource and returns the body to the agent's context window. This allows exfiltration of cloud metadata, temporary credentials, and internal service responses through the agent's output channel.

Root Cause

URL validation is performed only at the entry point of web_crawl, while the HTTP client is configured to automatically follow redirects. There is no per-hop validation callback and no allowlist enforcement on the resolved destination of each redirect.

Attack Vector

Exploitation requires the attacker to influence a URL that a PraisonAI agent will crawl. This can occur through prompt injection, user-supplied research targets, or compromised third-party pages linked from a legitimate crawl seed. The attacker-controlled host returns a redirect response pointing at an internal target.

python

# Conceptual illustration of the redirect-based SSRF flow
# 1. Agent invokes web_crawl("https://attacker.example/report")
# 2. Initial URL passes ALLOW_LOCAL_CRAWL validation (public host)
# 3. _crawl_with_httpx issues request with follow_redirects=True
# 4. attacker.example returns: HTTP/1.1 302 Found
#    Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/
# 5. httpx follows redirect without revalidation
# 6. Cloud metadata response returned into agent context

Additional hardening was introduced in the fix commit, including path-traversal sanitization for user_id in file-based memory and bearer-token authorization for server endpoints:

python

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

Source: GitHub Commit 2f9677a

Detection Methods for CVE-2026-55525

Indicators of Compromise

Outbound HTTP requests from PraisonAI hosts to 169.254.169.254, 100.100.100.200, or metadata.google.internal
Agent runtime connections to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback interfaces not present in application allowlists
HTTP 3xx responses from crawl targets whose Location header points to private, link-local, or loopback addresses

Detection Strategies

Instrument httpx client hooks or an outbound proxy to log every resolved URL after redirect following, then alert on non-public destinations
Correlate agent tool-invocation logs referencing web_crawl with subsequent egress traffic to sensitive internal ranges
Inspect agent context outputs for cloud metadata signatures such as AccessKeyId, SecretAccessKey, or iam/security-credentials

Monitoring Recommendations

Enable DNS and NetFlow logging on hosts running praisonaiagents and forward to a centralized analytics platform
Baseline expected crawl destinations per deployment and alert on deviations, particularly redirects that cross network trust boundaries
Monitor package inventory for praisonaiagents versions below 1.6.58 across development, staging, and production environments

How to Mitigate CVE-2026-55525

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later in all environments that expose agent-driven crawling
Audit agent tool configurations to confirm ALLOW_LOCAL_CRAWL remains disabled in production
Restrict egress from agent runtimes so cloud metadata endpoints and internal networks are unreachable at the network layer

Patch Information

The fix is delivered in PraisonAI release v4.6.58 and detailed in GHSA-5r34-2g38-6569. The underlying code changes are visible in commit 2f9677a, which hardens input validation, adds bearer-token authorization on the server, and closes the redirect revalidation gap.

Workarounds

Disable the web_crawl tool in agent configurations until upgrade is complete
Route agent HTTP traffic through an egress proxy that enforces destination allowlists and blocks link-local, loopback, and RFC1918 targets
Apply IMDSv2 requirements on AWS instances to require session tokens for metadata access, reducing SSRF impact against EC2 metadata

bash

# Upgrade to the patched version
pip install --upgrade 'praisonaiagents>=1.6.58'

# Verify installed version
python -c "import praisonaiagents, sys; print(praisonaiagents.__version__)"

# Example egress restriction for cloud metadata (Linux iptables)
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner praisonai -j REJECT