CVE-2026-57126: praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.58 - Compensating control
Harden network egress so the agent cannot reach loopback (127.0.0.0/8), private RFC1918 ranges, link-local addresses, or cloud metadata IPs, even if SSRF guard is bypassed via DNS names.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using praisonaiagents versions earlier than 1.6.58 are affected when SpiderTools performs scrape_page, crawl, extract_links, extract_text, or URL-mention fetches against attacker-influenced hostnames.
What does an attacker need to exploit this issue?
An attacker needs the ability to cause one of the affected SpiderTools operations to fetch a hostname they control. That hostname must resolve to a loopback, private, link-local, or cloud-metadata address; no DNS rebinding race is required.
What could an attacker access?
The SSRF policy can be bypassed, allowing the agent to connect to internal addresses and potentially expose the responses it receives. The issue can reach loopback, private, link-local, and cloud-metadata endpoints.
How can the issue be remediated?
Upgrade praisonaiagents to version 1.6.58 or later. The fix resolves DNS names rather than validating only literal IP address encodings.