Executive brief
PraisonAI, an AI agent framework, contains a vulnerability in its Jobs API that allows unauthenticated users to force the server to send web requests to arbitrary locations. This could be used to access sensitive internal data, such as cloud environment credentials or internal database information, and could lead to the exposure of AI agent results to unauthorized parties. An attacker can exploit this to map out a company's internal network or steal data processed by the AI.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v1/runs` endpoint of PraisonAI due to a lack of validation on the `webhook_url` parameter. The application uses `httpx.AsyncClient` to send POST requests to this user-supplied URL upon job completion or failure. Because the Jobs API lacks authentication by default and does not implement URL scheme restrictions or IP blocklists, an unauthenticated attacker can trigger requests to internal network resources, such as cloud metadata services (169.254.169.254) or internal APIs. This can result in the exfiltration of job results (including agent output) and internal network reconnaissance. The vulnerability is addressed in version 4.5.128.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory: GHSA-8frj-8q3m-xhgm published
- 2026-04-10: patched: Fixed in version 4.5.128