CVE-2026-55535: PraisonAI Jobs API SSRF Vulnerability

CVE-2026-55535 Overview

CVE-2026-55535 is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in PraisonAI, a multi-agent teams system. The flaw resides in the Jobs API validate_webhook_url() function. The validator fails open when socket.gaierror is raised and does not bind the resolved address to the subsequent HTTP request. An attacker-controlled webhook_url can therefore resolve to an internal address such as 127.0.0.1 or the cloud metadata endpoint 169.254.169.254 after validation completes. This creates a Server-Side Request Forgery (SSRF) primitive against internal services. The issue is tracked under CWE-367 and is fixed in praisonai 4.6.58.

Critical Impact
Attackers can coerce the PraisonAI Jobs API into issuing requests to internal networks and cloud metadata services, exposing credentials and sensitive infrastructure data.

Affected Products

PraisonAI (praisonai package) versions prior to 4.6.58
Deployments exposing the Jobs API webhook_url parameter to untrusted input
Cloud-hosted PraisonAI instances with reachable instance metadata services (IMDS)

Discovery Timeline

2026-08-25 - CVE-2026-55535 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55535

Vulnerability Analysis

The Jobs API accepts a webhook_url parameter and passes it through validate_webhook_url() before dispatching an HTTP callback. Two defects combine to produce the SSRF condition. First, when DNS resolution raises socket.gaierror, the validator returns success rather than rejecting the URL. Second, the validator resolves the hostname to an IP address for policy checks but does not pin that IP to the outbound request. The request layer performs an independent DNS lookup at send time.

Because the two DNS resolutions occur at different moments, an attacker controlling authoritative DNS for the supplied hostname can return a public address during validation and a private address such as 127.0.0.1 or 169.254.169.254 at request time. The vulnerability aligns with CWE-367: Time-of-check Time-of-use Race Condition.

Root Cause

The root cause is a missing bind between the validated address and the executed HTTP request. Exception handling for socket.gaierror also treats an unresolvable hostname as valid, allowing later successful resolution to internal targets. The patch in commit 2f9677a hardens input validation across the codebase, including the Jobs API webhook path.

Attack Vector

An unauthenticated network attacker submits a job with a webhook_url pointing to a hostname they control. The DNS server returns a benign public IP for the validation query, then rebinds to 169.254.169.254, 127.0.0.1, or a private range address for subsequent lookups. The Jobs API then issues the webhook request to the internal target, potentially returning cloud credentials, session tokens, or metadata to the attacker via any response reflection or side channel.

The patch introduces stricter input validation. Related hardening in the same commit includes path-traversal sanitization for user_id in the memory subsystem:

python

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

Source: PraisonAI commit 2f9677a

Detection Methods for CVE-2026-55535

Indicators of Compromise

Outbound HTTP requests from PraisonAI hosts to 169.254.169.254, 127.0.0.1, or RFC 1918 ranges originating from the Jobs API worker
Job submissions with webhook_url values referencing attacker-controlled domains with short DNS TTLs
Repeated DNS lookups for the same hostname resolving to different IP families within seconds

Detection Strategies

Inspect PraisonAI job creation logs for webhook_url values with uncommon TLDs or dynamic DNS providers
Correlate DNS query logs with process telemetry to identify DNS rebinding patterns against the Jobs API worker
Alert on any egress traffic from PraisonAI service accounts to link-local or loopback destinations

Monitoring Recommendations

Enable verbose logging on the Jobs API and forward records to a centralized analytics platform for retention and query
Monitor cloud IMDS access logs (AWS IMDSv2 audit, GCP metadata access) for requests sourced from PraisonAI workloads
Track the installed praisonai package version across hosts and flag versions below 4.6.58

How to Mitigate CVE-2026-55535

Immediate Actions Required

Upgrade praisonai to version 4.6.58 or later on all hosts running the Jobs API
Restrict egress from PraisonAI workloads to an allowlist of required destinations, blocking link-local and private ranges
Enforce IMDSv2 with hop-limit 1 on AWS instances to prevent metadata theft via SSRF

Patch Information

The fix is included in PraisonAI v4.6.58. Details are published in GHSA-hmfx-4v44-9qw9 and implemented in commit 2f9677a. Install with pip install --upgrade praisonai>=4.6.58.

Workarounds

Place PraisonAI behind an egress proxy that resolves and pins destination IPs, rejecting private and link-local addresses
Disable or authenticate the Jobs API webhook_url feature until the upgrade is applied
Run PraisonAI in a network namespace or VPC subnet with no route to 169.254.169.254 or internal management planes

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=4.6.58'

# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"