PraisonAI Flaws Enabled Unauthenticated Access and SSRF to Internal Services

Multiple vulnerabilities in PraisonAI and praisonaiagents exposed deployments to unauthorized access and server-side request forgery. CVE-2026-55528 stems from AgentServer declaring an auth_token but not enforcing it on any route, allowing remote unauthenticated users to subscribe, publish, and invoke other actions even when authentication was configured. The issue affects PraisonAI versions earlier than 4.6.58 and praisonaiagents versions earlier than 1.6.58, and was rated high severity with impact to integrity.

Two SSRF flaws also affected the platform’s network-facing features. CVE-2026-55526 allowed crafted hostnames such as 127.0.0.1.nip.io to bypass hostname blocking because spider_tools._host_is_blocked() did not resolve hostnames before requests were made, enabling access to loopback and other internal resources. Separately, CVE-2026-55537 exposed webhook handling to a DNS race and fail-open validation bug: an authenticated attacker with job submission rights and control of authoritative DNS could register a webhook that initially failed resolution, then repoint it before delivery so the background executor sent HTTP POST requests to internal targets including 127.0.0.1 and 169.254.169.254. A hardening commit added authentication enforcement, DNS-based SSRF checks, and broader fail-closed validation, while fixes were released in updated PraisonAI and praisonaiagents versions.