CVE-2026-34936 in PraisonAI
要約 (英語)
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a caller-controlled api_base parameter that is concatenated with endpoint and passed directly to httpx.Client.request() when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is applied, allowing requests to any host reachable from the server. This issue has been patched in version 4.5.90.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
責任者
GitHub_M
予約する
2026年03月31日
公開
2026年04月04日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 355244 | MervinPraison PraisonAI apassthrough 特権昇格 | 918 | 未定義 | 公式な修正 | CVE-2026-34936 |