CVE-2026-55535 in PraisonAI

Riassunto

di MITRE • 25/08/2026

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: GitHub M
• Prenotare: 17/06/2026
• Divulgazione: 25/08/2026
• Moderazione: accettato
• Voce: VDB-395072
• CPE: pronto
• CWE: CWE-918 (confermato)
• CVSS: 6.8 (CNA)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-55535
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55535
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-55535/