CVE-2026-55523: PraisonAI Agents SSRF

CISO Take

PraisonAI's web_crawl() tool, used by agents to fetch and summarize web content, blocks direct requests to loopback and private-network addresses but fails to revalidate the destination after an HTTP redirect, letting an attacker-controlled public URL redirect the underlying httpx client to internal services or cloud metadata endpoints like 169.254.169.254. This is the second bypass of the same flaw (following GHSA-qq9r-63f6-v542 / CVE-2026-40160), which signals the mitigation approach itself — URL-only validation — is structurally insufficient. A working PoC is public and CISA's SSVC assessment tracks it as TRACK_STAR, though EPSS puts real-world exploitation likelihood very low (0.34%, still in the top 73% percentile of scored CVEs) and it is not in CISA KEV, so this is not an emergency but a real gap for anyone running PraisonAI agents with internet-facing crawl capability, especially in cloud environments where a leaked IMDS response can hand over instance credentials. Upgrade to praisonaiagents 1.6.58 immediately, and don't rely on application-level allow-lists alone — enforce network-level egress controls (block RFC1918/link-local ranges, require IMDSv2 with a hop limit of 1) so a future bypass of the app-layer guard doesn't matter.

Sources: NVD GitHub Advisory EPSS ATLAS CISA SSVC

What is the risk?

Moderate risk despite the absence of a CVSS score: this is a two-time bypass of an SSRF guard (CVE-2026-40160 and now this issue) that shows app-level URL validation alone is not a durable defensive layer for network-fetching agent tools. Public PoC exploit code exists, but EPSS scores exploitation probability as very low (0.34%) and the CVE is not in CISA KEV, keeping real-world attacker interest low for now. Exposure scales with how web_crawl() is wired into an agent pipeline — if the crawled URL (or a redirect target it might visit) can be influenced by untrusted input (user-supplied links, scraped web content, prompt injection), an attacker gets a foothold to probe internal networks and cloud metadata services from the host running the agent.

How does the attack unfold?

Initial Access

Attacker gets a public, attacker-controlled URL passed into web_crawl(), either directly via an exposed crawl action or indirectly through content an agent is instructed to research.

AML.T0053

Validation Bypass

The URL resolves to a public IP and passes PraisonAI's initial loopback/private-network host check.

AML.T0049

SSRF Redirect

The attacker's server responds with an HTTP redirect to a loopback, private-network, or cloud metadata endpoint, which the unpatched httpx.Client(follow_redirects=True) follows without revalidation.

Data Exposure

The redirected response body — potentially containing cloud credentials or internal service data — is returned in the web_crawl() result and flows into the agent's context and downstream output.

AML.T0086

Initial Access

Attacker gets a public, attacker-controlled URL passed into web_crawl(), either directly via an exposed crawl action or indirectly through content an agent is instructed to research.

AML.T0053

Validation Bypass

The URL resolves to a public IP and passes PraisonAI's initial loopback/private-network host check.

AML.T0049

SSRF Redirect

The attacker's server responds with an HTTP redirect to a loopback, private-network, or cloud metadata endpoint, which the unpatched httpx.Client(follow_redirects=True) follows without revalidation.

Data Exposure

The redirected response body — potentially containing cloud credentials or internal service data — is returned in the web_crawl() result and flows into the agent's context and downstream output.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	>= 1.5.128, < 1.6.58	`1.6.58`
20 dependents 59% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade praisonaiagents to >=1.6.58, where the redirect target is revalidated against the same loopback/private-network blocklist as the original URL. If immediate upgrade isn't possible, disable or wrap the web_crawl tool to strip redirect-following (follow_redirects=False) or validate the resolved IP of every hop, not just the initial URL. Regardless of patch status, apply defense-in-depth at the network layer: run agent workloads in an egress-restricted network/container that blocks outbound traffic to RFC1918 ranges and 169.254.169.254, and require IMDSv2 with a hop-limit of 1 on any cloud instance running these agents so a successful SSRF can't retrieve credentials. For detection, monitor outbound connections from agent hosts to internal IP ranges or metadata IPs, and flag web_crawl() calls whose target URL redirects to a different host/IP than initially requested.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Agent Plugin Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation of third-party components

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-55523?

PraisonAI's web_crawl() tool, used by agents to fetch and summarize web content, blocks direct requests to loopback and private-network addresses but fails to revalidate the destination after an HTTP redirect, letting an attacker-controlled public URL redirect the underlying httpx client to internal services or cloud metadata endpoints like 169.254.169.254. This is the second bypass of the same flaw (following GHSA-qq9r-63f6-v542 / CVE-2026-40160), which signals the mitigation approach itself — URL-only validation — is structurally insufficient. A working PoC is public and CISA's SSVC assessment tracks it as TRACK_STAR, though EPSS puts real-world exploitation likelihood very low (0.34%, still in the top 73% percentile of scored CVEs) and it is not in CISA KEV, so this is not an emergency but a real gap for anyone running PraisonAI agents with internet-facing crawl capability, especially in cloud environments where a leaked IMDS response can hand over instance credentials. Upgrade to praisonaiagents 1.6.58 immediately, and don't rely on application-level allow-lists alone — enforce network-level egress controls (block RFC1918/link-local ranges, require IMDSv2 with a hop limit of 1) so a future bypass of the app-layer guard doesn't matter.

Is CVE-2026-55523 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55523, increasing the risk of exploitation.

How to fix CVE-2026-55523?

Upgrade praisonaiagents to >=1.6.58, where the redirect target is revalidated against the same loopback/private-network blocklist as the original URL. If immediate upgrade isn't possible, disable or wrap the web_crawl tool to strip redirect-following (follow_redirects=False) or validate the resolved IP of every hop, not just the initial URL. Regardless of patch status, apply defense-in-depth at the network layer: run agent workloads in an egress-restricted network/container that blocks outbound traffic to RFC1918 ranges and 169.254.169.254, and require IMDSv2 with a hop-limit of 1 on any cloud instance running these agents so a successful SSRF can't retrieve credentials. For detection, monitor outbound connections from agent hosts to internal IP ranges or metadata IPs, and flag web_crawl() calls whose target URL redirects to a different host/IP than initially requested.

What systems are affected by CVE-2026-55523?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, web-browsing/crawling agent tools, RAG pipelines, multi-agent orchestration.

What is the CVSS score for CVE-2026-55523?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksweb-browsing/crawling agent toolsRAG pipelinesmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx fallback uses httpx.Client(follow_redirects=True) and does not revalidate intermediate or final redirect targets. An attacker who can influence a URL passed to web_crawl(), directly or through an agent or tool workflow, can supply an attacker-controlled public URL that passes the initial host check and then redirects to loopback, private-network, or cloud metadata endpoints reachable from the host, with the redirected response body returned in the web_crawl() result. This constitutes an incomplete fix and patch bypass for the previously disclosed web_crawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160 and GHSA-8f4v-xfm9-3244), since the guard validates only the requested URL and not the destination actually fetched after redirection. This issue has been fixed in version 1.6.58.

Exploitation Scenario

An attacker sets up a public web page they control and gets its URL passed to web_crawl() — either directly, if the agent exposes crawling as a callable action to external users, or indirectly, by getting the URL embedded in content an autonomous agent is told to research (a document, a search result, or a prompt-injected instruction). The URL itself resolves to a public, non-private IP, so it sails through PraisonAI's initial host check. When the httpx client fetches it, the attacker's server responds with a redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> (or an internal admin endpoint); because follow_redirects=True and the redirect target is never re-checked, the client follows it and returns the metadata/credentials response body as the tool's crawl result. That data now sits in the agent's working context, where it can be echoed back to the attacker through the agent's own output, stored in logs or a downstream artifact, or used by the agent as if it were legitimate crawled content.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.