PraisonAI SSRF protection bypass via DNS rebinding in Jobs webhook

Executive brief

PraisonAI, an AI agent framework, contains a vulnerability in its background job system that allows attackers to bypass security filters. By using a technique called DNS rebinding, an attacker can trick the system into sending data to internal private servers or cloud management interfaces that should be protected. This could lead to unauthorized access to internal company data or the disruption of private internal services.

Technical details

PraisonAI's Async Jobs API implements a time-of-check/time-of-use (TOCTOU) vulnerability in its webhook validation logic. While the `webhook_url` is validated against private and loopback IP ranges during job submission using `socket.gethostbyname()`, the original hostname is stored and re-resolved by `httpx.AsyncClient` during actual delivery without further validation. An attacker can use a DNS rebinding attack to provide a public IP during the initial validation and a private/internal IP (such as 127.0.0.1 or cloud metadata services) during the actual POST request. This allows for blind SSRF against internal infrastructure. The vulnerability was addressed in version 4.6.59.

Affected products

• MervinPraison praisonai >= 4.5.126, <= 4.6.58

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched: Fixed in version 4.6.59

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D