Loading vulnerability…
PraisonAI Jobs API Webhook URL SSRF
CVE-2026-55535 is a server-side request forgery vulnerability in PraisonAI versions before 4.6.58. The Jobs API validate_webhook_url() logic fails open following DNS-resolution errors and does not bind the address validated during checking to the address used for the subsequent HTTP request. An attacker-controlled webhook destination can exploit DNS rebinding or resolution-error handling to cause the server to send requests to internal destinations. The flaw also has a time-of-check/time-of-use characteristic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker can cause the PraisonAI server to issue HTTP POST requests to loopback, private-network, link-local, administrative, database, and cloud-instance metadata services. This can expose sensitive metadata or data reachable only from the server network context and may enable interaction with internal services.
If you can’t patch tonight, do this now.
Until upgraded, disable or restrict untrusted webhook URL submission and allowlist approved webhook destinations. Apply outbound egress filtering that prevents the application from reaching loopback, private, link-local, and cloud metadata networks. Ensure URL-validation controls reject resolution failures and validate destination addresses at connection time and after redirects.
Patch, then assume compromise.
Upgrade PraisonAI to version 4.6.58 or later. The corrected implementation must fail closed on DNS lookup errors, reject prohibited resolved address classes, and bind or revalidate the destination address immediately before connection, including across redirects and all DNS results.
No public exploits tracked yet. Mallory keeps watching.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.