CVE-2026-55525: PraisonAI Agents SSRF

CISO Take

PraisonAI's web_crawl tool checks only the initial URL against its local-network blocklist, but the underlying httpx client follows redirects without re-validating them — so a crafted redirect can silently steer the crawl from an approved public URL to loopback, internal RFC1918 ranges, or cloud metadata endpoints (169.254.169.254), with the response handed straight back into the agent's context. There's no public exploit, no CISA KEV listing, and no EPSS score yet, so this isn't under active exploitation, but the vector requires no authentication, no user interaction, and only low attack complexity (CVSS 3.1/AV:N/AC:L, base 7.5) — any workflow that lets an agent crawl attacker-influenced or attacker-supplied URLs is exposed. With 20 known downstream dependents and 60 other CVEs already logged against this package family, PraisonAI has a track record of security debt worth tracking closely. Patch to praisonaiagents >= 1.6.58 immediately; until then, disable or sandbox the web_crawl tool, enforce egress filtering/network segmentation around any host running agent crawlers, and hard-block metadata endpoints at the network layer regardless of the ALLOW_LOCAL_CRAWL setting. Detection teams should hunt for outbound requests from agent hosts to 169.254.169.254, loopback, or private ranges immediately following an initial public-URL fetch — a strong signal of a redirect-based SSRF attempt.

Sources:NVDGitHub AdvisoryCISA KEVATLAS

What is the risk?

High-confidence, low-complexity SSRF (CVSS 7.5, confidentiality-only impact) in a widely-embedded agent tool-use path. Exploitability is straightforward for anyone who can influence a crawl target (via prompt injection, a malicious link in agent input, or a compromised upstream data source) since no auth or user interaction is needed and the flaw is a simple validate-once/fetch-many-times logic gap. No evidence of active exploitation (not in CISA KEV, no EPSS score, no public PoC or Nuclei template), which lowers near-term urgency, but the low complexity and network-reachable attack surface mean risk will rise quickly once a PoC circulates. Exposure is proportional to how many deployments actually invoke web_crawl with attacker-influenceable URLs (e.g., URLs sourced from user input, RAG documents, or third-party APIs) and whether those agents run inside cloud environments with metadata services reachable.

How does the attack unfold?

Entry point

Attacker gets an agent to crawl a URL they influence — via prompt injection, malicious content in a RAG source, or a webform the agent processes — which initially passes the ALLOW_LOCAL_CRAWL check.

AML.T0053

Redirect exploitation

The attacker-controlled server responds with an HTTP redirect to a loopback, private, or cloud metadata address; httpx.Client(follow_redirects=True) follows it without re-validating the new target.

AML.T0049

Internal data collection

The internal service's response (e.g., cloud IAM credentials from the metadata endpoint, or an internal admin page) is fetched and inserted into the agent's context.

AML.T0085.001

Exfiltration / impact

Leaked internal data surfaces in the agent's subsequent output or actions, letting the attacker retrieve cloud credentials or internal network information through the agent's normal response channel.

AML.T0024

Entry point

Attacker gets an agent to crawl a URL they influence — via prompt injection, malicious content in a RAG source, or a webform the agent processes — which initially passes the ALLOW_LOCAL_CRAWL check.

AML.T0053

Redirect exploitation

The attacker-controlled server responds with an HTTP redirect to a loopback, private, or cloud metadata address; httpx.Client(follow_redirects=True) follows it without re-validating the new target.

AML.T0049

Internal data collection

The internal service's response (e.g., cloud IAM credentials from the metadata endpoint, or an internal admin page) is fetched and inserted into the agent's context.

AML.T0085.001

Exfiltration / impact

Leaked internal data surfaces in the agent's subsequent output or actions, letting the attacker retrieve cloud credentials or internal network information through the agent's normal response channel.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	< 1.6.58	`1.6.58`
20 dependents63% patched~21d to patchFull package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade praisonaiagents to >= 1.6.58 immediately — this is the only complete fix, since it revalidates redirect targets rather than trusting the initial URL. 2) Until patched, disable the web_crawl tool or wrap it with an egress proxy that enforces the same allowlist/denylist on every redirect hop, not just the initial request. 3) At the network layer, block outbound access from agent-hosting instances to 169.254.169.254 and RFC1918 ranges unless explicitly required, and prefer IMDSv2 (which requires a session token, mitigating simple SSRF-to-metadata) on any cloud instance running agents. 4) Detection: monitor agent-host egress logs for HTTP redirects (3xx) whose Location header points to loopback/private/link-local addresses, and alert on any successful fetch to metadata IP ranges. 5) Review any agent workflow where crawl targets are derived from user input, RAG documents, or third-party content, since these are the realistic injection points for a malicious redirect chain.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionAuth BypassAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0075- Cloud Service Discovery AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

NIST AI RMF

MANAGE-2.3-Risks and benefits from third-party AI components are regularly monitored and managed

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-55525?

PraisonAI's web_crawl tool checks only the initial URL against its local-network blocklist, but the underlying httpx client follows redirects without re-validating them — so a crafted redirect can silently steer the crawl from an approved public URL to loopback, internal RFC1918 ranges, or cloud metadata endpoints (169.254.169.254), with the response handed straight back into the agent's context. There's no public exploit, no CISA KEV listing, and no EPSS score yet, so this isn't under active exploitation, but the vector requires no authentication, no user interaction, and only low attack complexity (CVSS 3.1/AV:N/AC:L, base 7.5) — any workflow that lets an agent crawl attacker-influenced or attacker-supplied URLs is exposed. With 20 known downstream dependents and 60 other CVEs already logged against this package family, PraisonAI has a track record of security debt worth tracking closely. Patch to praisonaiagents >= 1.6.58 immediately; until then, disable or sandbox the web_crawl tool, enforce egress filtering/network segmentation around any host running agent crawlers, and hard-block metadata endpoints at the network layer regardless of the ALLOW_LOCAL_CRAWL setting. Detection teams should hunt for outbound requests from agent hosts to 169.254.169.254, loopback, or private ranges immediately following an initial public-URL fetch — a strong signal of a redirect-based SSRF attempt.

Is CVE-2026-55525 actively exploited?

No confirmed active exploitation of CVE-2026-55525 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55525?

1) Upgrade praisonaiagents to >= 1.6.58 immediately — this is the only complete fix, since it revalidates redirect targets rather than trusting the initial URL. 2) Until patched, disable the web_crawl tool or wrap it with an egress proxy that enforces the same allowlist/denylist on every redirect hop, not just the initial request. 3) At the network layer, block outbound access from agent-hosting instances to 169.254.169.254 and RFC1918 ranges unless explicitly required, and prefer IMDSv2 (which requires a session token, mitigating simple SSRF-to-metadata) on any cloud instance running agents. 4) Detection: monitor agent-host egress logs for HTTP redirects (3xx) whose Location header points to loopback/private/link-local addresses, and alert on any successful fetch to metadata IP ranges. 5) Review any agent workflow where crawl targets are derived from user input, RAG documents, or third-party content, since these are the realistic injection points for a malicious redirect chain.

What systems are affected by CVE-2026-55525?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, tool-augmented agents.

What is the CVSS score for CVE-2026-55525?

CVE-2026-55525 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinestool-augmented agents

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0075Cloud Service Discovery

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

Exploitation Scenario

An attacker who can influence what URL an agent decides to crawl — e.g., by embedding a link in content ingested via RAG, submitting a support ticket or webform that an agent processes, or exploiting a downstream integration that passes attacker-controlled URLs to the agent — submits a public-looking URL that passes the initial ALLOW_LOCAL_CRAWL check. That URL's server responds with an HTTP redirect (3xx) to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` or `http://localhost:8080/admin`. Because `_crawl_with_httpx` uses `httpx.Client(follow_redirects=True)` without re-checking the redirect target, the crawl transparently follows it, retrieves the internal response (e.g., temporary cloud credentials or an internal admin page), and returns it into the agent's context window. The attacker then uses a follow-up prompt or observes the agent's subsequent output/actions to exfiltrate the leaked internal data, effectively turning the agent's own network position into an SSRF pivot into the victim's cloud or internal network.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.