CVE-2026-55524: PraisonAI Agents SSRF in web_crawl tool via redirect and DNS rebinding

CVE-2026-55524 · Severity: high · CVSS 7.5 · Published 2026-08-25

The web_crawl tool in PraisonAI Agents is used to fetch and analyze content from web URLs. An attacker can bypass its internal-network protection by crafting HTTP redirects or using DNS rebinding to make the tool access cloud metadata endpoints or internal services that should be blocked, potentially exposing sensitive credentials such as AWS IAM keys. This vulnerability can be triggered via direct user input or prompt injection attacks against AI agents that use this tool.

Technologies: MervinPraison PraisonAI Agents, praisonaiagents (PyPI). Vendors: MervinPraison, PyPI.

Quick answers

Is CVE-2026-55524 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55524 being exploited in the wild.
How severe is CVE-2026-55524?
High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?
MervinPraison PraisonAI Agents < 1.6.58; praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.58.
Is there a fix for CVE-2026-55524?
Yes. praisonaiagents (PyPI): upgrade to 1.6.58 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55524 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55524?
Check whether you run MervinPraison PraisonAI Agents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonaiagents (PyPI): upgrade to 1.6.58 or later
    pip install "praisonaiagents>=1.6.58"

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) stemming from a time-of-check time-of-use (TOCTOU) gap in src/praisonaiagents/tools/web_crawl_tools.py. The validation logic resolves the hostname once at check time using socket.gethostbyname() and rejects private/loopback/link-local IPs. However, the actual fetcher (httpx.Client with follow_redirects=True, or urllib.request.urlopen as fallback) re-resolves the hostname at connect time without re-validation. This gap is exploitable via two independent attack vectors: (1) HTTP redirects where a public-IP domain is approved at validation but the attacker's server responds with a 302 redirect to an internal address (e.g., 169.254.169.254), which the fetcher follows unchecked; and (2) DNS rebinding where a low-TTL attacker domain resolves to a public IP during validation but to a private/loopback address during the actual connection. An agent controlled via direct input or prompt injection can thereby read internal HTTP services and cloud metadata endpoints, leaking sensitive data such as IAM credentials. The patch is to pin the validated IP and connect to it directly, disable redirect following, or re-validate every redirect hop.

Affected products

  • MervinPraison PraisonAI Agents < 1.6.58

Identifiers

  • CVE-2026-55524
  • GHSA-vg6p-v9vm-6fgj
  • PYSEC-2026-3904

Timeline

  • 2026-06-13: disclosed: Advisory initially published by GitHub
  • 2026-08-05: advisory: Published to NVD
  • 2026-08-25: advisory: Updated in GitHub Advisory Database
  • 2026-06-13: patched: Fixed in version 1.6.58 (commit 2f9677a)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.