CVE-2026-57114
CVE-2026-57114 · PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.
CVSS 7.2 · High · Fix available
- Published
- Updated
Stack: python
Affected products and versions
praisonai
- Versions
- >= 4.5.126, < 4.6.59: Affected
No fix published
praisonai PyPI
- Versions
- 4.5.126
- 4.5.127
- 4.5.128
- 4.5.129
- 4.5.130
- 4.5.131
- 4.5.132
- 4.5.133
- 4.5.134
- 4.5.135
- 4.5.136
- 4.5.137
- 4.5.139
- 4.5.140
- 4.5.143
- 4.5.144
- 4.5.145
- 4.5.149
- 4.6.10
- 4.6.11
- 4.6.12
- 4.6.13
- 4.6.14
- 4.6.15
- 4.6.16
- 4.6.18
- 4.6.19
- 4.6.20
- 4.6.21
- 4.6.22
- 4.6.23
- 4.6.24
- 4.6.25
- 4.6.26
- 4.6.27
- 4.6.28
- 4.6.29
- 4.6.30
- 4.6.31
- 4.6.32
- 4.6.33
- 4.6.34
- 4.6.35
- 4.6.36
- 4.6.37
- 4.6.38
- 4.6.39
- 4.6.40
- 4.6.41
- 4.6.42
- 4.6.43
- 4.6.44
- 4.6.45
- 4.6.46
- 4.6.47
- 4.6.48
- 4.6.50
- 4.6.51
- 4.6.52
- 4.6.53
- 4.6.54
- 4.6.55
- 4.6.56
- 4.6.57
- 4.6.58
- 4.6.9
- Affected ranges
- ECOSYSTEM: ≥ 4.5.126, < 4.6.59
Update to 4.6.59