CVE-2026-57115 Overview
CVE-2026-57115 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system. The flaw resides in the SpiderTools.scrape_page function within praisonaiagents versions prior to 1.6.59. The function validates only the initial URL and allows requests.Session.get to follow HTTP redirects automatically. An attacker can supply a public-looking URL that redirects to loopback, private, link-local, or cloud metadata addresses. The response body from the redirected target is returned through scrape_page and its extract_links, crawl, and extract_text callers. This exposes internal services that would otherwise be blocked.
Critical Impact
An unauthenticated attacker can coerce a PraisonAI agent into fetching internal-only URLs, disclosing sensitive data from cloud metadata endpoints, internal APIs, and private network services.
Affected Products
- PraisonAI praisonaiagents versions prior to 1.6.59
- Applications embedding SpiderTools.scrape_page, extract_links, crawl, or extract_text
- Multi-agent workflows exposing PraisonAI scraping tools to user-supplied URLs
Discovery Timeline
- 2026-09-14 - CVE-2026-57115 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-57115
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. SpiderTools.scrape_page performs URL validation on the initial input only. It then delegates the HTTP fetch to requests.Session.get, which follows redirects by default. Because no revalidation occurs on the final resolved URL, attacker-controlled redirects bypass the initial allowlist or blocklist.
The redirected response body is returned to the caller. Downstream helpers extract_links, crawl, and extract_text inherit the same behavior. This creates multiple exploitation surfaces across the tool's API.
Root Cause
The root cause is missing post-redirect URL revalidation. The requests library follows 3xx responses automatically unless allow_redirects=False is set. PraisonAI relied solely on pre-request validation of the user-supplied URL, so a hostile server can redirect the agent to 127.0.0.1, 169.254.169.254 (AWS/GCP metadata), RFC 1918 private ranges, or link-local addresses.
Attack Vector
Exploitation requires user interaction to submit a URL to a PraisonAI agent using SpiderTools. The attacker hosts a public URL that returns a 30x redirect pointing at an internal target. The agent fetches the initial URL, transparently follows the redirect, and returns the internal response body to the attacker through the tool output.
The vulnerability is fixed in praisonaiagents 1.6.59. See the GitHub Security Advisory GHSA-6h9p-93hq-q7h6 and the remediation commit for technical details on the fix.
Detection Methods for CVE-2026-57115
Indicators of Compromise
- Outbound HTTP requests from PraisonAI hosts to 169.254.169.254, 127.0.0.0/8, or RFC 1918 ranges originating from agent tool invocations
- Agent logs showing SpiderTools.scrape_page, extract_links, crawl, or extract_text calls followed by responses containing cloud instance metadata fields such as iam/security-credentials
- Redirect chains in web proxy logs where an external host issues a 30x to an internal or metadata address
Detection Strategies
- Instrument the requests.Session used by PraisonAI to log final resolved URLs after redirects, and alert on private or link-local destinations
- Monitor egress network flows from agent runtime hosts for anomalous connections to internal subnets or metadata IPs
- Inspect agent tool outputs for tokens, private hostnames, or configuration data that indicate internal disclosure
Monitoring Recommendations
- Enable verbose logging on all PraisonAI tool invocations and forward to a centralized SIEM for correlation
- Deploy egress filtering telemetry that captures the full URL chain rather than only the initial request
- Baseline normal scraping destinations and alert on deviations toward internal address space
How to Mitigate CVE-2026-57115
Immediate Actions Required
- Upgrade praisonaiagents to version 1.6.59 or later immediately
- Audit any agent workflows that accept user-supplied URLs and route them through SpiderTools
- Rotate credentials that may have been exposed via cloud instance metadata if exploitation is suspected
Patch Information
The issue is fixed in praisonaiagents 1.6.59. Review the GitHub Release v4.6.59 notes and apply the update via pip install --upgrade praisonaiagents. The patch commit contains the redirect handling changes.
Workarounds
- Disable SpiderTools scraping tools in agent configurations until the upgrade is applied
- Enforce network-layer egress controls that block agent hosts from reaching 169.254.169.254 and internal subnets
- Deploy an outbound HTTP proxy that rejects requests resolving to private, loopback, or link-local addresses at every hop
# Configuration example: upgrade the vulnerable package
pip install --upgrade 'praisonaiagents>=1.6.59'
# Verify installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
