Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a security flaw that allows attackers to redirect the server's internal network requests. By providing a malicious web address, an attacker can force the server to communicate with internal systems or cloud metadata services that are normally hidden from the public internet. This could lead to the theft of sensitive cloud credentials or unauthorized access to internal databases and services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `passthrough()` and `apassthrough()` functions of PraisonAI due to insufficient validation of the `api_base` parameter. When the `litellm` primary path raises an `AttributeError`, the system falls back to a request where the user-supplied `api_base` is concatenated with an endpoint and passed directly to `httpx.Client.request()`. Because there is no URL scheme validation, private IP filtering, or domain allowlisting, an attacker can target internal services (e.g., Redis, Kubernetes API) or cloud metadata services (e.g., AWS IMDSv1) to retrieve sensitive credentials. While the CVSS indicates low privileges are required, the default configuration of the Flask API server often has authentication disabled, potentially increasing the risk. The issue is fixed in version 4.5.90.
Affected products
- MervinPraison PraisonAI < 4.5.90
Timeline
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-03: patched: Fix released in version 4.5.90