CVE-2026-61429 Overview
CVE-2026-61429 is a server-side request forgery (SSRF) vulnerability in PraisonAI versions before 1.6.78. The flaw resides in the Crawl4AI/Chromium backend that handles URL fetching through a headless browser. Attackers bypass SSRF validation by combining DNS rebinding with HTTP redirects. The initial URL passes the validation check because it resolves to an external address. The headless browser then re-resolves the hostname or follows a redirect to an internal target. This allows adversaries to read responses from internal services, including sensitive canary values used to gate access. The issue is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can pivot from PraisonAI's crawler into internal networks, reading responses from services that should be unreachable from the public internet.
Affected Products
- PraisonAI versions prior to 1.6.78
- Deployments using the Crawl4AI backend
- Deployments using the Chromium headless browser fetcher
Discovery Timeline
- 2026-07-11 - CVE-2026-61429 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-61429
Vulnerability Analysis
PraisonAI accepts user-supplied URLs and fetches them using the Crawl4AI/Chromium backend. The application applies SSRF validation by resolving the hostname and rejecting private, loopback, and link-local addresses. The validation occurs once, before the fetch, and the headless browser performs its own independent hostname resolution and redirect handling. This gap creates a time-of-check to time-of-use (TOCTOU) condition specific to network resolution.
Attackers exploit the gap in two ways. First, DNS rebinding returns a public IP for the validator and a private IP for the browser's subsequent lookup. Second, an attacker-controlled server returns an HTTP redirect (3xx) pointing to an internal address such as http://127.0.0.1, http://169.254.169.254, or an RFC1918 host. Chromium follows the redirect without re-invoking the SSRF filter and returns the internal response body to the caller.
Root Cause
The root cause is inconsistent enforcement of SSRF policy between the pre-flight validator and the fetch engine. Validation is not re-applied on each DNS resolution or on redirect targets. The vulnerability is classified as [CWE-918].
Attack Vector
Exploitation is remote over the network and requires low privileges (an authenticated user able to submit a crawl request). No user interaction is required. A successful attack yields high confidentiality impact against internal services, including cloud instance metadata endpoints and unauthenticated admin panels. The advisory notes that internal canary values can be retrieved, demonstrating cross-boundary data exposure.
The vulnerability manifests in the crawler's URL handling and redirect-following logic. See the GitHub Security Advisory GHSA-6g59-gm2v-qhvq and the VulnCheck SSRF Advisory for full technical details.
Detection Methods for CVE-2026-61429
Indicators of Compromise
- Outbound crawler requests to hostnames whose DNS responses alternate between public and private addresses within short TTL windows.
- Chromium or Crawl4AI process connections to 127.0.0.1, 169.254.169.254, or RFC1918 ranges originating from the PraisonAI service.
- HTTP 3xx responses in crawler logs where the Location header points to internal or loopback addresses.
Detection Strategies
- Inspect PraisonAI application logs for crawl requests whose final fetched URL differs from the submitted URL, especially when the final host is private.
- Correlate DNS query logs with subsequent socket connections; flag hostnames that resolve to both external and internal addresses within one session.
- Alert on any egress from the PraisonAI worker to metadata service IPs such as 169.254.169.254 (AWS/Azure/GCP).
Monitoring Recommendations
- Enable audit logging on the Crawl4AI backend, capturing redirect chains and resolved IPs for every fetch.
- Deploy egress filtering at the network layer and log any denied connection attempts from the PraisonAI service account.
- Monitor authenticated PraisonAI API usage for anomalous submission patterns targeting URL-shortening or attacker-controlled domains.
How to Mitigate CVE-2026-61429
Immediate Actions Required
- Upgrade PraisonAI to version 1.6.78 or later on all deployments.
- Restrict who can submit crawl or URL-fetch requests, reducing the low-privilege attack surface.
- Block egress from the PraisonAI worker to RFC1918, loopback, and cloud metadata addresses at the network boundary.
Patch Information
PraisonAI 1.6.78 addresses the vulnerability. Patch details are available in the GitHub Security Advisory GHSA-6g59-gm2v-qhvq. Administrators running earlier versions should schedule an immediate upgrade.
Workarounds
- Run the Crawl4AI/Chromium backend inside a network namespace or container with no route to internal subnets or metadata endpoints.
- Force all outbound HTTP traffic from the crawler through a filtering egress proxy that re-validates each resolved IP and each redirect target.
- Disable redirect following in the crawler configuration, or cap redirect depth to zero for untrusted URLs, until the patch is deployed.
# Example egress restriction using iptables on the PraisonAI host
# Block loopback, RFC1918, and cloud metadata targets for the crawler user
sudo iptables -A OUTPUT -m owner --uid-owner praisonai -d 127.0.0.0/8 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner praisonai -d 10.0.0.0/8 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner praisonai -d 172.16.0.0/12 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner praisonai -d 192.168.0.0/16 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner praisonai -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
