Server-Side Request Forgery Vulnerability in PraisonAI by Mervin Praison
CVE-2026-55523

7.7HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
5 August 2026

What is CVE-2026-55523?

A vulnerability exists in PraisonAI within the web_crawl_tools.web_crawl() function, which can be exploited to perform server-side request forgery (SSRF). In affected versions, the function accepts URLs with initial validation but fails to verify the final destination after redirection, allowing attackers to manipulate URLs that can lead to sensitive endpoints within the local network. The issue is an incomplete fix of a previously disclosed SSRF vulnerability, compromising the security of systems utilizing this functionality. The vulnerability has been patched in version 1.6.58, emphasizing the importance of updating to mitigate risks.

Affected Version(s)

PraisonAI >= 1.5.128, < 1.6.58

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.