CVE-2026-55526: PraisonAI SSRF Vulnerability

CVE-2026-55526 Overview

CVE-2026-55526 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system built on the praisonaiagents Python package. Versions prior to 1.6.58 fail to resolve hostnames before fetching them in the spider_tools.scrape_page function. The _host_is_blocked() check operates only on the raw hostname string, allowing crafted DNS names such as 127.0.0.1.nip.io to pass validation while resolving to loopback or internal addresses. Attackers with low-privileged network access can pivot the agent into internal HTTP services. The issue is fixed in praisonaiagents version 1.6.58, which uses socket.getaddrinfo and fails closed on DNS errors.

Critical Impact
Authenticated attackers can coerce PraisonAI agents into fetching internal HTTP endpoints, exposing cloud metadata services, internal APIs, and loopback-bound applications.

Affected Products

PraisonAI praisonaiagents package versions prior to 1.6.58
Multi-agent deployments using spider_tools.scrape_page
Applications embedding PraisonAI agents with network egress

Discovery Timeline

2026-08-25 - CVE-2026-55526 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55526

Vulnerability Analysis

The vulnerability resides in spider_tools._host_is_blocked(), a validation routine intended to prevent PraisonAI's scraping tool from reaching internal or loopback destinations. The function inspects the hostname component of a URL against a blocklist but never performs DNS resolution. Because HTTP clients resolve hostnames at request time, an attacker-controlled name that appears external can resolve to 127.0.0.1, 169.254.169.254, or RFC1918 space.

This pattern is classified under [CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action]. In an agentic AI context, the impact is amplified because prompts or tool inputs can indirectly control the URLs passed to scrape_page, turning prompt injection into an SSRF primitive.

Root Cause

The blocklist check treats the hostname as opaque text. Names such as 127.0.0.1.nip.io, localtest.me, or any attacker-registered domain whose A record points to internal space bypass the filter. The fetcher then issues an outbound HTTP request that terminates inside the trust boundary of the host running PraisonAI.

Attack Vector

An attacker with the ability to submit URLs to a PraisonAI agent, either directly through an API or indirectly through prompt injection, supplies a hostname that resolves to an internal IP. The scraper fetches the target and returns response content to the agent, leaking metadata, credentials, or internal service state.

python

# Illustrative fix pattern applied in praisonaiagents 1.6.58
# The patched _host_is_blocked() resolves the hostname and fails closed on DNS errors.
import socket
import ipaddress

def _host_is_blocked(hostname: str) -> bool:
    try:
        infos = socket.getaddrinfo(hostname, None)
    except socket.gaierror:
        return True  # fail closed
    for family, _, _, _, sockaddr in infos:
        ip = ipaddress.ip_address(sockaddr[0])
        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
            return True
    return False

Source: GitHub Security Advisory GHSA-x44h-65qv-cw74

Detection Methods for CVE-2026-55526

Indicators of Compromise

Outbound HTTP requests from PraisonAI hosts to 127.0.0.0/8, 169.254.169.254, or RFC1918 ranges initiated by the agent process.
DNS queries from agent workloads for domains such as *.nip.io, *.sslip.io, or localtest.me that resolve to internal addresses.
Agent logs showing scrape_page invocations with hostnames whose resolved addresses fall inside the trust boundary.

Detection Strategies

Correlate agent tool invocation logs with resolved DNS answers to flag requests where the final IP is internal despite an external-looking hostname.
Alert on any successful HTTP response from PraisonAI to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Baseline the set of domains legitimately scraped by agents and flag first-seen hostnames issued by praisonaiagents.

Monitoring Recommendations

Enable egress logging and DNS query logging on hosts running PraisonAI workloads.
Route agent HTTP traffic through an authenticated forward proxy that enforces destination allowlists.
Monitor the installed version of praisonaiagents across the fleet and alert on versions below 1.6.58.

How to Mitigate CVE-2026-55526

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later across all environments running PraisonAI.
Audit tool invocation history for scrape_page calls targeting hostnames that resolve to internal addresses.
Restrict egress from agent workloads at the network layer, blocking access to metadata IPs and internal service CIDRs.

Patch Information

The fix is available in PraisonAI release v4.6.58. The remediation commit (2f9677a) hardens _host_is_blocked() by calling socket.getaddrinfo on the hostname, evaluating every resolved address against private, loopback, link-local, and reserved ranges, and failing closed on DNS errors. Additional hardening in the same commit sanitizes user_id inputs against path traversal and adds bearer-token authorization on the agent server.

Workarounds

Deploy a forward proxy with strict destination allowlisting for all agent HTTP traffic if immediate patching is not possible.
Disable or remove the spider_tools.scrape_page tool from agent configurations until the upgrade is applied.
Enforce network policies that block agent pods from reaching 169.254.169.254, 127.0.0.0/8, and internal service ranges.

bash

# Upgrade praisonaiagents to the patched release
pip install --upgrade 'praisonaiagents>=1.6.58'

# Verify installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"