Executive brief
PraisonAI, an AI agent framework, contains a security flaw in its Jobs API that allows unauthorized users to trigger network requests from the server. By default, the API does not require a password, enabling attackers to send commands that force the server to connect to internal systems or private services that are not normally accessible from the internet. This could lead to the exposure of internal data or unauthorized access to other services within the company's private network.
Technical details
An unauthenticated SSRF vulnerability exists in the PraisonAI Jobs API /api/v1/runs endpoint. The application fails to enforce authentication by default unless the PRAISONAI_JOBS_API_KEY environment variable is explicitly set. The 'webhook_url' parameter is subject to a Time-of-Check to Time-of-Use (TOCTOU) flaw: while the application validates the hostname against private IP ranges at request time, it re-resolves the hostname during the connection phase using httpx. This allows an attacker to use DNS rebinding to bypass the blacklist and reach internal services. The impact is a blind SSRF, allowing attackers to send POST requests to internal infrastructure and potentially exfiltrate job results. The issue is fixed in version 4.6.78.
Affected products
- MervinPraison PraisonAI < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date
- 2026-07-10: patched: Fix confirmed in version 4.6.78