CVE-2026-57126: PraisonAI SSRF Vulnerability

CVE-2026-57126 Overview

CVE-2026-57126 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in PraisonAI, a multi-agent teams system. Versions of praisonaiagents prior to 1.6.58 contain a flawed URL validation routine in SpiderTools._validate_url. The helper _host_is_blocked inspects only the literal host encoding and never resolves DNS names before the agent connects. An attacker who controls a hostname that resolves to a loopback, private, link-local, or cloud metadata address can therefore bypass the SSRF policy. The affected code paths include scrape_page, crawl, extract_links, extract_text, and URL-mention fetches. The issue is fixed in praisonaiagents 1.6.58.

Critical Impact
Attackers can coerce PraisonAI agents into fetching internal HTTP resources, including cloud instance metadata endpoints, and return the responses to the agent context.

Affected Products

PraisonAI praisonaiagents package prior to version 1.6.58
Agents using SpiderTools methods (scrape_page, crawl, extract_links, extract_text)
Workflows that fetch URL mentions through PraisonAI agent tools

Discovery Timeline

2026-09-14 - CVE-2026-57126 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57126

Vulnerability Analysis

The vulnerability sits in the SSRF protection logic used by PraisonAI's SpiderTools. Before making an outbound HTTP request, the tool calls _validate_url, which delegates host-safety checks to _host_is_blocked. That helper compares the literal host string against a blocklist of loopback, private, link-local, and metadata ranges. It does not perform DNS resolution. As a result, hostnames that resolve to blocked IP addresses pass validation and reach the HTTP client. The connection itself then resolves the hostname and contacts the internal target. Because SSRF bypass depends only on DNS records the attacker controls, no rebinding race is required. Responses from internal services are returned to the agent, exposing configuration data, credentials, and cloud metadata tokens to downstream LLM reasoning.

Root Cause

The blocklist enforcement operates on the input string rather than on the resolved socket address. The check assumes that unsafe destinations always appear as raw IP literals, but attacker-owned domains can point to any target. The fix in version 1.6.58 hardens input validation and query parameterization across PraisonAI's memory, server, and tool code paths.

Attack Vector

An authenticated user with permission to submit URLs to an agent registers a domain (for example, internal.attacker.tld) with an A record pointing to 169.254.169.254, 127.0.0.1, or an RFC 1918 address. The user then submits that URL to any tool backed by SpiderTools. Validation succeeds because the hostname is not on the literal blocklist. The HTTP client resolves the name and reaches the internal endpoint. The response, including any leaked cloud metadata or internal API data, is returned to the agent and can be exfiltrated through the model's output.

python

# Excerpt from the 1.6.58 hardening commit (memory/file_memory.py)
@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

Detection Methods for CVE-2026-57126

Indicators of Compromise

Outbound DNS queries from PraisonAI hosts resolving external domains to RFC 1918, loopback, or 169.254.169.254 addresses.
Agent HTTP requests to cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ originating from tool invocations.
Agent conversation logs containing internal service banners, IAM credentials, or private API responses.

Detection Strategies

Audit SpiderTools invocations for user-supplied URLs and correlate them with downstream socket destinations that fall inside private ranges.
Deploy egress network policies that log or block PraisonAI worker connections to link-local and private address space, and alert on any denials.
Inspect application logs for calls to scrape_page, crawl, extract_links, and extract_text with hostnames whose resolved addresses differ from expected external targets.

Monitoring Recommendations

Enable DNS query logging on PraisonAI worker nodes and alert when external hostnames resolve to internal address space.
Monitor cloud metadata service access counters; unexpected reads from application workloads indicate SSRF activity.
Track the installed version of the praisonaiagents package across environments and flag any host still running a release earlier than 1.6.58.

How to Mitigate CVE-2026-57126

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later on every host that runs PraisonAI agents or tools.
Rotate any cloud credentials, IAM tokens, or internal API keys that were reachable from PraisonAI workers during the exposure window.
Restrict which users and workflows can submit URLs to SpiderTools-backed tools until patching is verified.

Patch Information

The fix is delivered in PraisonAI release v4.6.58, corresponding to praisonaiagents 1.6.58. See the GitHub Security Advisory GHSA-vxgj-xg5c-p4h7 and the hardening commit 2f9677a for the code-level changes to input validation and query parameterization.

Workarounds

Enforce network-layer egress filtering so PraisonAI workers cannot reach loopback, RFC 1918, link-local, or cloud metadata addresses.
Require IMDSv2 with hop-limit 1 on AWS instances to prevent metadata theft when SSRF is possible.
Front outbound HTTP traffic with a forward proxy that resolves DNS itself and rejects internal targets before the request leaves the host.

bash

# Upgrade to the patched release
pip install --upgrade "praisonaiagents>=1.6.58"

# Verify the installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"