CVE-2026-55524: PraisonAI SSRF bypass in web_crawl

CISO Take

PraisonAI's web_crawl tool checks a URL's hostname for private, loopback, and link-local addresses before fetching, but it validates once via a single DNS lookup and then hands the URL to an HTTP client (httpx or urllib) configured to follow redirects and re-resolve the hostname at connect time — so an attacker-controlled redirect or a timed DNS-rebinding response slips past the check entirely. For CISOs running PraisonAI agents that ingest untrusted URLs (scraped web content, user-submitted links, RAG source material), this is a textbook SSRF that can reach cloud metadata endpoints, internal admin panels, or loopback services, with the fetched response body returned directly in the tool output — a credential-exfiltration path through a single agent tool call. There's no public exploit or Nuclei template yet, EPSS sits at just 0.19%, and it isn't in CISA KEV, so this isn't being mass-exploited today; CISA's SSVC decision of TRACK_STAR reflects a track-and-monitor posture rather than urgent action. Attack complexity is rated high only because exploitation requires redirect control or DNS-rebinding infrastructure — both well-documented, low-cost techniques readily available to any motivated attacker — so any deployment where web_crawl processes attacker-influenceable URLs should be treated as exploitable now. Patch to PraisonAI 1.6.58 or later, and in the meantime enforce network-level egress controls (block outbound requests from the PraisonAI host to RFC1918/loopback/link-local ranges and the 169.254.169.254 metadata address) rather than relying on the application's now-proven-bypassable validation.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 7.5) driven by a confidentiality impact against internal network resources, but real-world risk is currently moderated by low EPSS (0.19%), absence from CISA KEV, no public exploit code, and no Nuclei coverage — reflected in CISA's TRACK_STAR SSVC decision. The attack complexity is rated 'high' by CVSS but this understates practical risk: DNS rebinding and open-redirect abuse are mature, tooling-supported techniques, not novel research. The core danger is architectural — a validate-then-fetch gap (CWE-367 TOCTOU combined with CWE-918 SSRF) — which means the fix in 1.6.58 must close the gap at fetch time, not just re-run the same check earlier. Any organization exposing PraisonAI agents to untrusted or semi-trusted URL input (public-facing agents, RAG pipelines pulling external content, or multi-agent workflows where one agent's output feeds another's web_crawl call) should treat this as actively exploitable regardless of the low EPSS score, since EPSS underweights agentic/tool-invocation attack paths.

How does the attack unfold?

Entry point

Attacker influences a URL passed to the web_crawl tool, directly via API input or indirectly through an agent/tool workflow (e.g., content the agent ingests).

AML.T0053

Initial validation

PraisonAI resolves the hostname once with socket.gethostbyname and rejects it if it maps to a private, loopback, or link-local IP.

Validation bypass

The URL is passed to an HTTP client that follows redirects and re-resolves the hostname at connect time; an attacker-controlled redirect or DNS-rebinding response points the actual connection to an internal or metadata address, bypassing the earlier check.

AML.T0049

Impact

PraisonAI fetches the internal/metadata resource and returns the response body directly in the web_crawl result, exposing sensitive internal data or credentials to the attacker.

AML.T0086

Entry point

Attacker influences a URL passed to the web_crawl tool, directly via API input or indirectly through an agent/tool workflow (e.g., content the agent ingests).

AML.T0053

Initial validation

PraisonAI resolves the hostname once with socket.gethostbyname and rejects it if it maps to a private, loopback, or link-local IP.

Validation bypass

The URL is passed to an HTTP client that follows redirects and re-resolves the hostname at connect time; an attacker-controlled redirect or DNS-rebinding response points the actual connection to an internal or metadata address, bypassing the earlier check.

AML.T0049

Impact

PraisonAI fetches the internal/metadata resource and returns the response body directly in the web_crawl result, exposing sensitive internal data or credentials to the attacker.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 65% patched ~13d to patch Full package profile →
PraisonAI Agents	pip	< 1.6.58	`1.6.58`
20 dependents 59% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

1) Upgrade to PraisonAI >= 1.6.58, which fixes the validate-here/fetch-there gap. 2) Until patched, deploy PraisonAI hosts behind egress network controls that block outbound connections to RFC1918 private ranges, 127.0.0.0/8 loopback, 169.254.0.0/16 link-local (including the 169.254.169.254 cloud metadata address), and ::1/fc00::/7 IPv6 equivalents — this closes the gap regardless of application-layer validation flaws. 3) If cloud metadata access is required for legitimate workloads, use IMDSv2 (AWS) or equivalent token-bound metadata service protections that resist SSRF-based retrieval. 4) Disable follow_redirects on any HTTP client used for tool-driven fetches, or re-validate the resolved IP after every redirect hop rather than only on the initial URL. 5) Monitor for anomalous outbound connections from PraisonAI hosts to internal IP ranges or metadata endpoints as a detection signal for exploitation attempts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0075 - Cloud Service Discovery AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-55524?

PraisonAI's web_crawl tool checks a URL's hostname for private, loopback, and link-local addresses before fetching, but it validates once via a single DNS lookup and then hands the URL to an HTTP client (httpx or urllib) configured to follow redirects and re-resolve the hostname at connect time — so an attacker-controlled redirect or a timed DNS-rebinding response slips past the check entirely. For CISOs running PraisonAI agents that ingest untrusted URLs (scraped web content, user-submitted links, RAG source material), this is a textbook SSRF that can reach cloud metadata endpoints, internal admin panels, or loopback services, with the fetched response body returned directly in the tool output — a credential-exfiltration path through a single agent tool call. There's no public exploit or Nuclei template yet, EPSS sits at just 0.19%, and it isn't in CISA KEV, so this isn't being mass-exploited today; CISA's SSVC decision of TRACK_STAR reflects a track-and-monitor posture rather than urgent action. Attack complexity is rated high only because exploitation requires redirect control or DNS-rebinding infrastructure — both well-documented, low-cost techniques readily available to any motivated attacker — so any deployment where web_crawl processes attacker-influenceable URLs should be treated as exploitable now. Patch to PraisonAI 1.6.58 or later, and in the meantime enforce network-level egress controls (block outbound requests from the PraisonAI host to RFC1918/loopback/link-local ranges and the 169.254.169.254 metadata address) rather than relying on the application's now-proven-bypassable validation.

Is CVE-2026-55524 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55524, increasing the risk of exploitation.

How to fix CVE-2026-55524?

1) Upgrade to PraisonAI >= 1.6.58, which fixes the validate-here/fetch-there gap. 2) Until patched, deploy PraisonAI hosts behind egress network controls that block outbound connections to RFC1918 private ranges, 127.0.0.0/8 loopback, 169.254.0.0/16 link-local (including the 169.254.169.254 cloud metadata address), and ::1/fc00::/7 IPv6 equivalents — this closes the gap regardless of application-layer validation flaws. 3) If cloud metadata access is required for legitimate workloads, use IMDSv2 (AWS) or equivalent token-bound metadata service protections that resist SSRF-based retrieval. 4) Disable follow_redirects on any HTTP client used for tool-driven fetches, or re-validate the resolved IP after every redirect hop rather than only on the initial URL. 5) Monitor for anomalous outbound connections from PraisonAI hosts to internal IP ranges or metadata endpoints as a detection signal for exploitation attempts.

What systems are affected by CVE-2026-55524?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations, RAG pipelines, multi-agent orchestration.

What is the CVSS score for CVE-2026-55524?

CVE-2026-55524 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrationsRAG pipelinesmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0075 Cloud Service Discovery

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.

Exploitation Scenario

An attacker embeds a URL in content that a PraisonAI-based agent will process — for example, a support ticket, a document ingested into a RAG pipeline, or a direct API call to an agent exposing the web_crawl tool. The URL initially points to a public, benign-looking domain, passing the SSRF hostname check. When the httpx/urllib client actually connects, the attacker's DNS server resolves that same hostname to 169.254.169.254 (DNS rebinding) — or the initial URL redirects via HTTP 302 to an internal address, which the redirect-following client fetches without re-checking. The PraisonAI host retrieves the cloud metadata response (including short-lived IAM credentials) and returns it as the web_crawl tool's output, which is then visible to the attacker either directly in an API response or via the agent's downstream reasoning/output.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE-918 Server-Side Request Forgery (SSRF)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.