CVE-2026-55535: PraisonAI server-side request forgery in webhook_url validation

Executive brief

PraisonAI is an AI orchestration platform that processes jobs with webhook callbacks. The Jobs API allows attackers to trigger server-side requests to arbitrary internal systems (databases, admin panels, cloud metadata APIs) through DNS rebinding attacks or by specifying domains that fail to resolve, bypassing validation controls. This enables unauthenticated access to sensitive internal infrastructure that would normally be protected from external access.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) with Time-of-Check Time-of-Use (TOCTOU) race condition characteristics in src/praisonai/jobs/models.py line 55. The webhook URL validator attempts to resolve the hostname and checks if the resulting IP is private or loopback; however, it silently passes validation if socket.gaierror is raised (DNS resolution failure). Later, in executor.py line 402, the HTTP POST request is made without re-validating the resolved IP address. An attacker can exploit this via DNS rebinding (register a domain with short TTL pointing to public IP, submit job, switch DNS to internal IP before execution) or by using unresolvable domains. Exploitable without authentication. Fixed in version 4.6.58.

Affected products

• MervinPraison PraisonAI <= 4.6.48

Timeline

• 2026-06-13: disclosed
• 2026-06-13: patched: Fixed in version 4.6.58
• 2026-08-25: advisory

References

• https://api.github.com/users/vndasunkid
• https://github.com/vndasunkid
• https://api.github.com/users/vndasunkid/gists%7B/gist_id%7D
• https://api.github.com/users/vndasunkid/repos
• https://avatars.githubusercontent.com/u/98982131?v=4
• https://api.github.com/users/vndasunkid/events%7B/privacy%7D