{"id":"CVE-2026-55524","title":"PraisonAI is a multi-agent teams system","summary":"PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-367","CWE-918"],"vendor":"praisonaiagents","product":"praisonaiagents","affected":["praisonaiagents < 1.6.58"],"patched":["praisonaiagents 1.6.58"],"published":"2026-08-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:51:43.490","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55524","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55524"},{"url":"https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"},{"url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"},{"url":"https://github.com/advisories/GHSA-vg6p-v9vm-6fgj"},{"url":"https://github.com/MervinPraison/PraisonAI"},{"url":"https://pypi.org/project/praisonaiagents"}],"tags":["nvd","ghsa","pip","osv"],"epss":0.00194,"epssPercentile":0.09332,"aliases":["GHSA-vg6p-v9vm-6fgj","PYSEC-2026-3904"],"ecosystem":"pip","ingestedAt":"2026-08-25T15:27:53.499Z","slug":"CVE-2026-55524","body":"## Overview\n\nPraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55524)\n\nAffected packages:\n\n- `praisonaiagents < 1.6.58`\n\nPatched in:\n\n- `praisonaiagents 1.6.58`\n\nSource: https://github.com/advisories/GHSA-vg6p-v9vm-6fgj","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}