CVE-2026-57114: PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, sendwebhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed?
PraisonAI versions 4.5.126 through before 4.6.59 are affected. Exposure requires use of the Async Jobs API with attacker-controlled or otherwise untrusted webhook_url values.
What does an attacker need to exploit this issue?
An attacker needs to submit a job with a webhook hostname they control and cause that hostname to resolve differently over time. It must resolve to a public IP during URL validation, then to a loopback, private, or cloud-metadata address when the completed job sends its webhook.
Why does the existing SSRF validation not prevent exploitation?
The URL is checked when the job request is parsed and when the internal Job object is created, but the later webhook request does not revalidate the destination or pin the previously validated IP address. The original hostname is passed to the HTTP client at delivery time, allowing DNS rebinding to change the request destination.
How can the issue be remediated?
Upgrade PraisonAI to version 4.6.59, which patches the issue.