CVE-2026-61430: PraisonAI SSRF Vulnerability

CVE-2026-61430 Overview

CVE-2026-61430 is a server-side request forgery (SSRF) vulnerability in PraisonAI versions before 1.6.78. The flaw resides in the web_crawl tool, which validates target hostnames at check time but re-resolves them at connection time without pinning the resolved IP address. Attackers with low privileges can exploit this time-of-check to time-of-use (TOCTOU) gap using DNS rebinding to reach internal HTTP services. Successful exploitation returns response bodies from loopback or private network endpoints to the attacker. The vulnerability is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can bypass SSRF protections in PraisonAI to read HTTP responses from internal services such as cloud metadata endpoints, admin panels, and loopback-bound applications.

Affected Products

PraisonAI versions prior to 1.6.78
Deployments exposing the web_crawl tool to untrusted or low-privileged users
Environments where PraisonAI agents run alongside internal HTTP services or cloud metadata endpoints

Discovery Timeline

2026-07-15 - CVE-2026-61430 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61430

Vulnerability Analysis

The web_crawl tool in PraisonAI accepts user-supplied URLs for fetching remote content. Before dispatching the HTTP request, the tool resolves the hostname and checks whether the resulting IP address belongs to a disallowed range such as loopback, link-local, or private networks. This validation returns a decision based on a single DNS lookup.

The underlying HTTP client then performs its own independent DNS resolution when opening the TCP connection. Because the validated IP address is not pinned or reused, an attacker-controlled DNS server can return a public IP during the check and a private IP during the connection. The tool consequently fetches content from internal endpoints and returns response bodies to the caller.

The vulnerability requires low privileges and no user interaction. Exploitation targets confidentiality of internal HTTP resources reachable from the PraisonAI host.

Root Cause

The root cause is a classic TOCTOU flaw between DNS-based allowlist validation and the actual socket connection. The web_crawl implementation trusts that a hostname resolves to the same IP address across successive lookups. Without IP pinning, connection-time resolution can be manipulated to point at addresses excluded by the check.

Attack Vector

An attacker registers a domain and configures its authoritative DNS server to alternate responses between a public IP and an internal target such as 127.0.0.1 or 169.254.169.254. The attacker submits a URL containing that hostname to a PraisonAI agent invoking web_crawl. The validation step resolves the public IP and passes. The HTTP client re-resolves the hostname, receives the internal IP, and fetches the internal resource. The response body is returned to the attacker through the agent's normal output channel.

See the VulnCheck SSRF Advisory and the GitHub Security Advisory GHSA-qg25-6gc4-48mg for additional technical detail.

Detection Methods for CVE-2026-61430

Indicators of Compromise

Outbound DNS queries from PraisonAI hosts to attacker-controlled domains with unusually short TTL values, indicating rebinding attempts
HTTP requests from PraisonAI processes to loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 addresses immediately following external DNS lookups
web_crawl tool invocations containing hostnames that resolve to multiple IP addresses across a short interval

Detection Strategies

Correlate DNS resolution logs with subsequent socket connections from the PraisonAI process to detect divergence between resolved and connected IPs
Alert on any egress from PraisonAI worker processes to cloud metadata endpoints such as 169.254.169.254 or Kubernetes API service IPs
Inspect agent execution logs for web_crawl calls whose target hostnames exhibit DNS TTL values under 60 seconds

Monitoring Recommendations

Log full URL arguments passed to web_crawl and retain DNS resolver telemetry for at least 30 days for retrospective analysis
Monitor PraisonAI outbound traffic at an egress proxy that enforces allowlists independent of application-layer validation
Track PraisonAI version inventory to confirm all instances run 1.6.78 or later

How to Mitigate CVE-2026-61430

Immediate Actions Required

Upgrade PraisonAI to version 1.6.78 or later on every host and container image
Restrict access to the web_crawl tool to trusted operators until upgrades complete
Deploy an egress firewall or forward proxy that blocks PraisonAI hosts from reaching private, loopback, and metadata address ranges

Patch Information

The fix is included in PraisonAI 1.6.78. Details are published in the GitHub Security Advisory GHSA-qg25-6gc4-48mg. Operators should rebuild container images and redeploy agent workers rather than performing in-place library updates.

Workarounds

Route all outbound HTTP traffic from PraisonAI through a proxy that resolves hostnames once and forwards to a validated IP, eliminating the TOCTOU gap
Disable or remove the web_crawl tool from agent configurations if remote fetching is not required
Apply network segmentation to place PraisonAI workers on a subnet with no route to internal management interfaces or cloud metadata services

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=1.6.78'

# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"