---
id: CVE-2026-55524
title: PraisonAI is a multi-agent teams system
summary: >-
  PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the
  web_crawl tool performs its SSRF check only on the initially supplied URL,
  allowing the protection to be bypassed so the tool connects to attacker-chosen
  internal …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-367
  - CWE-918
vendor: praisonaiagents
product: praisonaiagents
affected:
  - praisonaiagents < 1.6.58
patched:
  - praisonaiagents 1.6.58
published: '2026-08-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55524'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj
    label: security-advisories@github.com
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55524'
  - url: >-
      https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
  - url: 'https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58'
  - url: 'https://github.com/advisories/GHSA-vg6p-v9vm-6fgj'
  - url: 'https://github.com/MervinPraison/PraisonAI'
  - url: 'https://pypi.org/project/praisonaiagents'
tags:
  - nvd
  - ghsa
  - pip
  - osv
epss: 0.00242
epssPercentile: 0.13702
aliases:
  - GHSA-vg6p-v9vm-6fgj
  - PYSEC-2026-3904
ecosystem: pip
ingestedAt: '2026-08-25T15:27:53.499Z'
---

## Overview

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55524)

Affected packages:

- `praisonaiagents < 1.6.58`

Patched in:

- `praisonaiagents 1.6.58`

Source: https://github.com/advisories/GHSA-vg6p-v9vm-6fgj