CVE-2026-47390: PraisonAI SSRF protection bypass in spider_tools via loopback encodings

CVE-2026-47390 · Severity: medium · CVSS 5.5 · Published 2026-07-21

PraisonAI, a system for managing multi-agent AI teams, contains a security flaw in its web-scraping tools. The system attempts to prevent agents from accessing internal or private network services, but this protection can be bypassed using specially formatted web addresses. An attacker could exploit this to force the AI system to interact with sensitive internal services that are not intended to be accessible from the outside, potentially leading to unauthorized data access.

Quick answers

Is CVE-2026-47390 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47390 being exploited in the wild.
How severe is CVE-2026-47390?
Medium severity, with a CVSS score of 5.5, published 21 July 2026.
Which products and versions are affected?
MervinPraison PraisonAI < 4.6.40; MervinPraison praisonaiagents < 1.6.40.
Is there a fix for CVE-2026-47390?
A patch was published on 2026-05-19: Fixes merged in GitHub PR #1684 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47390 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47390?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `spider_tools` component of PraisonAI due to insufficient URL validation. The `_validate_url` function in `praisonaiagents/tools/spider_tools.py` utilizes a weak blocklist that only checks for exact host strings like 'localhost' and '127.0.0.1'. It fails to perform DNS resolution, hostname normalization, or validation of numeric IPv4 variants (such as octal, hexadecimal, or dword formats). Consequently, an attacker can bypass these checks using encodings like `http://127.1` or `http://0x7f000001` to reach loopback-only services. Once validation is bypassed, `scrape_page()` executes a request via `requests.Session.get()`. The issue is addressed in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40.

Affected products

  • MervinPraison PraisonAI < 4.6.40
  • MervinPraison praisonaiagents < 1.6.40

Identifiers

  • CVE-2026-47390
  • GHSA-5c6w-wwfq-7qqm

Timeline

  • 2026-05-19: patched: Fixes merged in GitHub PR #1684
  • 2026-07-21: disclosed: CVE-2026-47390 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.