PULSE
LIVE64signals / 24h
ES
FEED
ransomincransom reclama a vprj.org · US · Not Foundransompanzer reclama a Surakarta University · ID · Educationransompanzer reclama a Festina Group · CH · Retail & E-Commerceransomclop reclama a nuv******* · Not Foundransomclop reclama a ipm******* · Not Foundransomclop reclama a ecc******* · Not Foundransomclop reclama a st******* · Not Foundransomclop reclama a qc******* · Not Foundransomclop reclama a flu******* · Not Foundransomclop reclama a mid******* · Not Foundransomclop reclama a itk******* · Not Foundransomclop reclama a G3A******* · Not Foundransomclop reclama a arc******* · Technologyransomclop reclama a omn******* · Not Foundransomincransom reclama a vprj.org · US · Not Foundransompanzer reclama a Surakarta University · ID · Educationransompanzer reclama a Festina Group · CH · Retail & E-Commerceransomclop reclama a nuv******* · Not Foundransomclop reclama a ipm******* · Not Foundransomclop reclama a ecc******* · Not Foundransomclop reclama a st******* · Not Foundransomclop reclama a qc******* · Not Foundransomclop reclama a flu******* · Not Foundransomclop reclama a mid******* · Not Foundransomclop reclama a itk******* · Not Foundransomclop reclama a G3A******* · Not Foundransomclop reclama a arc******* · Technologyransomclop reclama a omn******* · Not Found
← All CVEs
CVE WatchAug 5, 2026

CVE-2026-55524

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially suppl

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 5, 2026 · Last modified: Aug 5, 2026 · CWE-367 · CWE-918

EPSS · 30d

Not enough EPSS history yet.

Technical description

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-349667.6 HIG
—
———Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.6hCVE-2026-55523—
—
———PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx fallback uses httpx.Client(follow_redirects=True) and does not revalidate intermediate or final redirect targets. An attacker who can influence a URL passed to web_crawl(), directly or through an agent or tool workflow, can supply an attacker-controlled public URL that passes the initial host check and then redirects to loopback, private-network, or cloud metadata endpoints reachable from the host, with the redirected response body returned in the web_crawl() result. This constitutes an incomplete fix and patch bypass for the previously disclosed web_crawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160 and GHSA-8f4v-xfm9-3244), since the guard validates only the requested URL and not the destination actually fetched after redirection. This issue has been fixed in version 1.6.58.7hCVE-2026-90817.1 HIG
—
———IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).8hCVE-2026-76576.5 MED
—
———IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.8hCVE-2026-176178.5 HIG
—
———IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.9hCVE-2026-92038.5 HIG
—
———A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.8h