Unauthenticated Server-Side Request Forgery in PraisonAI
CVE-2026-60091

6.9MEDIUM

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
10 July 2026

What is CVE-2026-60091?

The PraisonAI application prior to version 4.6.78 is vulnerable to an unauthenticated server-side request forgery (SSRF) through its Jobs API at the /api/v1/runs endpoint. This vulnerability arises due to inadequate validation of the webhook_url parameter, which, while initially checked at the request stage, is re-resolved during the connection phase. This flaw permits attackers to exploit the application via DNS rebinding techniques, potentially gaining access to internal services without authentication, leading to serious security implications.

Affected Version(s)

PraisonAI 0 < 4.6.78

PraisonAI 4.6.78

References

https://github.com/MervinPraison/PraisonAI/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/praisonai-before-una...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dinhvaren
.