Loading vulnerability…
PraisonAI praisonaiagents hostname-validation SSRF
CVE-2026-55526 is a server-side request forgery vulnerability in PraisonAI and its praisonaiagents component before praisonaiagents 1.6.58 (and associated PraisonAI releases before 4.6.58). The hostname-blocking logic used by web-scraping functionality validated ordinary hostnames without resolving them before the HTTP request was made. An attacker-controlled hostname can therefore pass validation while resolving to a loopback, private, link-local, multicast, or other prohibited address. Version 1.6.58 resolves hostnames using socket.getaddrinfo and rejects DNS-resolution failures.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who can cause an agent to retrieve an attacker-controlled URL can conduct read SSRF with arbitrary port access to services reachable from the affected host. This can expose localhost and private-network HTTP services. In cloud deployments, access to an exposed instance metadata service may disclose instance IAM credentials and could enable compromise of associated cloud resources.
If you can’t patch tonight, do this now.
Until upgrades are deployed, do not expose web-scraping capabilities, including page scraping, link extraction, crawling, and text extraction, to untrusted user-controlled URLs. Enforce egress filtering that denies access to loopback, RFC1918/private, link-local, multicast, and cloud metadata networks. Reject hostname resolution failures and block requests when any resolved destination is prohibited.
Patch, then assume compromise.
Upgrade praisonaiagents to version 1.6.58 or later, and upgrade PraisonAI to the corresponding fixed release, 4.6.58 or later. The fixed implementation resolves requested hostnames before fetching, rejects destinations resolving to prohibited address classes, and fails closed on DNS errors. Validation should cover every resolved address and the connection should be bound to a validated destination to limit multi-record and DNS-rebinding bypasses.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.