# CVE-2026-40114: PraisonAI SSRF in Jobs API webhook_url

Source: https://junglewise.ai/threats/cve-2026-40114-praisonai-ssrf-in-jobs-api-webhook-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40114 · Severity: high · CVSS 7.2 · Published 2026-04-09

PraisonAI, an AI agent framework, contains a vulnerability in its Jobs API that allows unauthenticated users to force the server to send web requests to arbitrary locations. This could be used to access sensitive internal data, such as cloud environment credentials or internal database information, and could lead to the exposure of AI agent results to unauthorized parties. An attacker can exploit this to map out a company's internal network or steal data processed by the AI.

Technologies: [Praisonai](https://junglewise.ai/threats/technologies/praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40114 being exploited in the wild.

**How severe is CVE-2026-40114?** High severity, with a CVSS score of 7.2, published 9 April 2026.

**Which products and versions are affected?** praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

**Is there a fix for CVE-2026-40114?** Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40114?** Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.5.128 or later

  ```sh
  pip install "praisonai>=4.5.128"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v1/runs` endpoint of PraisonAI due to a lack of validation on the `webhook_url` parameter. The application uses `httpx.AsyncClient` to send POST requests to this user-supplied URL upon job completion or failure. Because the Jobs API lacks authentication by default and does not implement URL scheme restrictions or IP blocklists, an unauthenticated attacker can trigger requests to internal network resources, such as cloud metadata services (169.254.169.254) or internal APIs. This can result in the exfiltration of job results (including agent output) and internal network reconnaissance. The vulnerability is addressed in version 4.5.128.

## Affected products

- MervinPraison PraisonAI < 4.5.128

## Identifiers

- CVE-2026-40114
- GHSA-8frj-8q3m-xhgm
- PYSEC-2026-2906

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory: GHSA-8frj-8q3m-xhgm published
- 2026-04-10: patched: Fixed in version 4.5.128

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)