CVE-2026-47390: PraisonAI SSRF bypass

CISO Take

PraisonAI's spider_tools implements SSRF protection using an exact-string blocklist that fails to normalize alternate loopback representations — decimal integers, octal notation, hex, and trailing-dot variants all bypass the check and reach localhost-bound services. In agentic deployments where user-controlled or LLM-generated URLs are passed to scrape_page() or crawl(), an attacker can exfiltrate responses from local admin panels, cloud metadata endpoints (169.254.169.254), or any service bound exclusively to loopback. With 69 prior CVEs in this package and SSRF being a well-understood cloud pivot technique, the exploitation bar is low once an attacker has influence over agent inputs — a realistic condition in RAG pipelines or multi-agent workflows. Upgrade to praisonai 4.6.40 or praisonaiagents 1.6.40 immediately; if patching is delayed, add egress firewall rules blocking loopback and RFC-1918 ranges at the network layer.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity by CVSS (5.5), but contextually elevated for cloud-deployed AI agents. The vulnerability bypasses an explicit security control rather than exploiting a default-open behavior, creating false confidence in developers who believe SSRF protection is active. EPSS data unavailable; no active exploitation observed and not in CISA KEV. Blast radius is modest with 1 reported downstream dependent, but any PraisonAI deployment processing externally-influenced URLs is directly in scope. The local-attack-vector CVSS classification likely reflects standalone desktop use; in containerized or cloud agent deployments, effective exploitability is higher since the attack can be initiated remotely through agent task inputs.

How does the attack unfold?

Initial Influence

Attacker supplies or injects a loopback URL using an alternate encoding (e.g., http://2130706433:8080/ or http://0x7f000001:8080/) into agent input, a crawled webpage, or RAG-indexed content.

AML.T0051.001

Validation Bypass

spider_tools._validate_url() compares the raw hostname string against an exact blocklist and approves the alternate loopback form without DNS resolution or IP normalization.

AML.T0049

SSRF Request

requests.Session.get() issues an HTTP request to the loopback address, reaching a local-only service such as an admin panel, development server, or cloud instance metadata API.

AML.T0053

Data Exfiltration

The local service response — potentially containing credentials, internal tokens, or configuration data — is returned as agent tool output and may appear in logs, agent context, or user-facing responses.

AML.T0086

Initial Influence

Attacker supplies or injects a loopback URL using an alternate encoding (e.g., http://2130706433:8080/ or http://0x7f000001:8080/) into agent input, a crawled webpage, or RAG-indexed content.

AML.T0051.001

Validation Bypass

spider_tools._validate_url() compares the raw hostname string against an exact blocklist and approves the alternate loopback form without DNS resolution or IP normalization.

AML.T0049

SSRF Request

requests.Session.get() issues an HTTP request to the loopback address, reaching a local-only service such as an admin panel, development server, or cloud instance metadata API.

AML.T0053

Data Exfiltration

The local service response — potentially containing credentials, internal tokens, or configuration data — is returned as agent tool output and may appear in logs, agent context, or user-facing responses.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI Agents	pip	<= 1.6.39	`1.6.40`
11 dependents 65% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

4 steps

Patch: upgrade praisonai to >= 4.6.40 or praisonaiagents to >= 1.6.40.
Network egress hardening (defense-in-depth): block outbound connections to 127.0.0.0/8, ::1, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 via iptables/nftables or cloud security groups on agent host environments.
If implementing custom URL validation, always resolve hostnames to IP addresses using socket.getaddrinfo() before blocklist evaluation — never compare raw hostname strings against a blocklist.
Detection: scan application and proxy logs for outbound requests containing hex IPs (0x7f...), octal notation (0177...), or decimal-encoded loopback (2130706433); in agentic frameworks, audit tool invocation logs for unusual localhost-variant URL patterns.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.9.3 - Operational planning and control

NIST AI RMF

MS-2.6 - Risk or impact assessment for known AI vulnerabilities

OWASP LLM Top 10

LLM07:2025 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-47390?

PraisonAI's spider_tools implements SSRF protection using an exact-string blocklist that fails to normalize alternate loopback representations — decimal integers, octal notation, hex, and trailing-dot variants all bypass the check and reach localhost-bound services. In agentic deployments where user-controlled or LLM-generated URLs are passed to scrape_page() or crawl(), an attacker can exfiltrate responses from local admin panels, cloud metadata endpoints (169.254.169.254), or any service bound exclusively to loopback. With 69 prior CVEs in this package and SSRF being a well-understood cloud pivot technique, the exploitation bar is low once an attacker has influence over agent inputs — a realistic condition in RAG pipelines or multi-agent workflows. Upgrade to praisonai 4.6.40 or praisonaiagents 1.6.40 immediately; if patching is delayed, add egress firewall rules blocking loopback and RFC-1918 ranges at the network layer.

Is CVE-2026-47390 actively exploited?

No confirmed active exploitation of CVE-2026-47390 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47390?

1. Patch: upgrade praisonai to >= 4.6.40 or praisonaiagents to >= 1.6.40. 2. Network egress hardening (defense-in-depth): block outbound connections to 127.0.0.0/8, ::1, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 via iptables/nftables or cloud security groups on agent host environments. 3. If implementing custom URL validation, always resolve hostnames to IP addresses using socket.getaddrinfo() before blocklist evaluation — never compare raw hostname strings against a blocklist. 4. Detection: scan application and proxy logs for outbound requests containing hex IPs (0x7f...), octal notation (0177...), or decimal-encoded loopback (2130706433); in agentic frameworks, audit tool invocation logs for unusual localhost-variant URL patterns.

What systems are affected by CVE-2026-47390?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, web scraping agents, multi-agent pipelines.

What is the CVSS score for CVE-2026-47390?

CVE-2026-47390 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesweb scraping agentsmulti-agent pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.9.3

NIST AI RMF: MS-2.6

OWASP LLM Top 10: LLM07:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, `scrape_page()` calls `requests.Session.get()` on the attacker-controlled URL. This allows an attacker who can influence URLs passed to `scrape_page`, `crawl`, or `extract_text` to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

Exploitation Scenario

An adversary embeds a crafted URL in content indexed by a PraisonAI agent's RAG pipeline or a web page being crawled — for example, a page containing a link using http://2130706433:8080/admin. When the agent processes this content and invokes scrape_page() to follow the URL, the weak string-based validation approves the decimal-encoded loopback address, and requests.Session issues a GET to the local admin service. The server response — containing configuration data, session tokens, or internal API credentials — is returned as tool output to the agent, where it may be logged, embedded in agent context, or surfaced to the requesting user. In a cloud environment, substituting the metadata service path (http://2130706433/latest/meta-data/iam/security-credentials/) yields IAM credentials for the underlying host instance.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.