Logical Flaw in PraisonAI Leading to Server-Side Request Forgery Vulnerability
CVE-2026-44335

7.7HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
8 May 2026

What is CVE-2026-44335?

PraisonAI, a multi-agent teams system, has a significant logical flaw in its URL checking mechanism prior to version 1.6.32. This vulnerability can be exploited by attackers to perform Server-Side Request Forgery (SSRF) attacks, potentially allowing them to manipulate server requests and access sensitive information. The issue has been addressed in version 1.6.32. It is crucial for users of the affected versions to update to this patched version to mitigate the risk.

Affected Version(s)

PraisonAI < 1.6.32

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.