CVE-2026-57143 in PraisonAI Agents
Summary
by MITRE • 10/12/2026
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within PraisonAI prior to version 1.6.62 represents a critical server-side request forgery flaw inherent in the integration of external search providers with large language model agents. Specifically, the searxng_search function and the associated search_web SearxNG provider fail to enforce strict validation on the searxng_url parameter before passing it directly to the requests.get library. This architectural oversight allows an attacker who controls or influences the LLM's output to manipulate the URL structure without restriction regarding scheme, host, port, or resolved IP address. In a multi-agent system where agents autonomously execute tools based on model predictions, this lack of validation creates a direct pathway for prompt injection attacks to escalate into network-level exploitation against internal infrastructure.
From a technical perspective, the core issue lies in the absence of input sanitization and destination verification mechanisms within the search tool implementation. By accepting any URL string provided by the LLM context, the application effectively acts as an open proxy or blind SSRF vector. An attacker can craft prompts that cause the agent to generate URLs pointing to localhost addresses, private network ranges such as 10.x.x.x or 192.168.x.x, or cloud metadata endpoints like http://169.254.169.254/. Since the requests library does not inherently restrict outbound connections based on destination safety in this context, the application will attempt to fetch data from these internal resources. This behavior aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where a web server retrieves content from an unintended location due to insufficient validation of user-supplied input.
The operational impact of this vulnerability is severe, particularly in environments where PraisonAI agents are deployed within internal networks or connected to sensitive backend services. The primary risk involves the exfiltration of data through returned JSON results that enter the agent's context window. Attackers can use this channel to distinguish between open and closed ports on internal hosts by observing differences in response times or error messages, a technique known as port scanning via SSRF. Furthermore, the ability to access cloud metadata services poses a significant threat to identity and access management systems. Successful exploitation could lead to the retrieval of temporary security credentials, instance profiles, or other sensitive configuration data stored at standard cloud provider endpoints, potentially granting unauthorized administrative control over cloud resources.
This vulnerability also maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle (AitM) and Local Network Discovery variants where attackers leverage compromised systems to probe internal networks. Additionally, it relates to T1046, Network Service Scanning, as the ability to test port states allows for detailed mapping of internal network topology. The integration of these results into the agent context means that sensitive data retrieved from internal services becomes part of the ongoing conversation or decision-making process, potentially leading to further automated actions by other agents in the multi-agent team if they are configured to act upon such contextual information without secondary verification.
To mitigate this vulnerability, organizations must upgrade immediately to PraisonAI version 1.6.62 or later, where the developers have implemented necessary safeguards against these injection vectors. For environments that cannot yet update, defensive measures should include implementing a strict allowlist for permitted URL schemes and destination IP ranges at the application level before any HTTP requests are initiated. Network-level controls such as egress filtering can also be employed to block outbound connections from agent execution environments to private IP spaces or cloud metadata endpoints. Additionally, integrating input validation layers that parse URLs and verify their components against a predefined set of safe domains ensures that LLM-controlled parameters cannot redirect traffic to unintended internal resources. Regular security audits focusing on tool integration points within autonomous AI systems are essential to prevent similar SSRF patterns in future deployments.