CVE-2026-55535 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical server-side request forgery flaw rooted in improper error handling within the Jobs API's webhook validation logic. Specifically, the validate_webhook_url function exhibits an open failure mode when encountering socket.gaierror exceptions during DNS resolution or network connectivity checks. Instead of rejecting the input as invalid due to these transient errors, the code proceeds with a false positive assumption that the URL is safe for subsequent processing. This logical flaw allows an attacker to manipulate the validation outcome by inducing conditions where standard error checking fails silently or incorrectly, thereby bypassing security controls designed to prevent access to internal resources.
The operational impact of this vulnerability centers on the potential for Server-Side Request Forgery attacks against local infrastructure and cloud metadata services. Because the validated address is not strictly bound or re-verified before being used in subsequent requests, an attacker can supply a malicious webhook URL that resolves to sensitive internal endpoints upon execution. Common targets include 127.0.0.1 for localhost services, 169.254.169.254 which is the standard IP address for cloud provider metadata services such as AWS EC2 instance metadata or Azure managed identity tokens, and other private network addresses that are typically inaccessible from external networks but reachable by the server itself. By leveraging this flaw, an attacker could potentially exfiltrate sensitive configuration data, authentication credentials, or internal service responses without direct access to those resources.
This issue aligns with CWE-918 Server-Side Request Forgery and specifically relates to improper validation of user-supplied input in network contexts. The failure to bind the validated address suggests a lack of strict allow-listing or canonicalization checks that are standard practice in secure coding guidelines for handling external inputs destined for internal networks. Furthermore, this vulnerability can be exploited via ATT&CK technique T1190 Exploit Public-Facing Application, as it involves manipulating an exposed API endpoint to achieve unauthorized access to internal resources. The severity is heightened by the fact that cloud metadata endpoints often contain high-value secrets such as temporary security credentials or IAM role information, making successful exploitation potentially catastrophic for the integrity and confidentiality of the deployed environment.
To mitigate this vulnerability, organizations must upgrade PraisonAI to version 4.6.58 or later where the validation logic has been corrected to properly handle socket errors and enforce strict address binding. In addition to upgrading, developers should implement robust input validation strategies that include DNS rebinding protection mechanisms such as resolving hostnames early in the request lifecycle and verifying that the resolved IP addresses do not fall within private RFC 1918 ranges or cloud metadata blocks unless explicitly permitted by business logic. Implementing network-level controls like egress filtering can also provide a defense-in-depth layer, preventing outbound connections to unauthorized internal subnets regardless of application-layer vulnerabilities. Regular security audits focusing on error handling paths in API endpoints are recommended to identify similar patterns of open failures that could lead to other types of injection or forgery attacks.