# CVE-2026-40160: MervinPraison PraisonAIAgents SSRF in web_crawl tool

Source: https://junglewise.ai/threats/cve-2026-40160-mervinpraison-praisonaiagents-ssrf-in-web-crawl-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40160 · Severity: high · CVSS 6.5 · Published 2026-04-10

PraisonAIAgents is a library for building AI-powered agents. A security flaw in its web crawling tool allows an attacker to trick an AI agent into accessing internal company servers or cloud metadata services. This could lead to the theft of sensitive information, such as cloud access credentials or internal database contents, which are then returned to the attacker.

Technologies: [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents), [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40160 being exploited in the wild.

**How severe is CVE-2026-40160?** High severity, with a CVSS score of 6.5, published 10 April 2026.

**Which products and versions are affected?** MervinPraison PraisonAI Agents >= 0.13.23, < 1.5.128; praisonaiagents (PyPI) ECOSYSTEM:introduced=0.13.23,fixed=1.5.128.

**Is there a fix for CVE-2026-40160?** Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40160 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40160?** Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.128 or later

  ```sh
  pip install "praisonaiagents>=1.5.128"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_crawl` tool's httpx fallback path within `web_crawl_tools.py`. The component fails to validate user-supplied URLs before passing them to `httpx.AsyncClient.get()` with `follow_redirects=True`. An attacker can exploit this via direct interaction or indirect prompt injection to reach internal network resources, including cloud metadata endpoints (IMDSv1) and localhost. The vulnerability is present in default installations where Tavily or Crawl4AI are not configured. A fix is available in version 1.5.128 which implements proper scheme and IP address validation.

## Affected products

- MervinPraison praisonaiagents >= 0.13.23, < 1.5.128

## Identifiers

- CVE-2026-40160
- GHSA-qq9r-63f6-v542
- PYSEC-2026-2951

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory

## References

- [https://api.github.com/users/Mundi-Xu](https://api.github.com/users/Mundi-Xu)
- [https://github.com/Mundi-Xu](https://github.com/Mundi-Xu)
- [https://api.github.com/users/Mundi-Xu/gists%7B/gist_id%7D](https://api.github.com/users/Mundi-Xu/gists%7B/gist_id%7D)
- [https://api.github.com/users/Mundi-Xu/repos](https://api.github.com/users/Mundi-Xu/repos)
- [https://avatars.githubusercontent.com/u/43680784?v=4](https://avatars.githubusercontent.com/u/43680784?v=4)
- [https://api.github.com/users/Mundi-Xu/events%7B/privacy%7D](https://api.github.com/users/Mundi-Xu/events%7B/privacy%7D)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)