SSRF Vulnerability in PraisonAI Affecting Multi-Agent Systems
CVE-2026-57114

7.2HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-57114?

PraisonAI versions 4.5.126 to 4.6.58 are vulnerable to a Server-Side Request Forgery (SSRF) attack. The Async Jobs API improperly validates the webhook_url across two different stages, allowing attackers to exploit the system by resolving controlled hostnames to sensitive internal resources during webhook deliveries. This vulnerability exposes the infrastructure to potential unauthorized access and information disclosure, bypassing previous safeguards intended to mitigate such risks. It is essential to update to version 4.6.59 or later to remediate this issue.

Affected Version(s)

PraisonAI >= 4.5.126, < 4.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.