CVE-2026-55535: PraisonAI TOCTOU SSRF

CISO Take

PraisonAI's Jobs API lets a caller register a webhook_url for job callbacks, but validate_webhook_url() fails open when DNS resolution throws socket.gaierror and never binds the address it validated to the address actually used when the request is later made. That gap lets an attacker who controls DNS for their webhook domain pass validation against a benign public IP, then flip the record to 127.0.0.1 or the cloud metadata address 169.254.169.254 before the real request fires — a classic TOCTOU SSRF. The CVSS 6.8 score reflects high attack complexity (timing a DNS change or forcing a resolution failure is nontrivial) but high confidentiality impact and a changed scope, since a successful hit can reach internal services or exfiltrate cloud IAM credentials from the metadata endpoint. There's no EPSS score, no CISA KEV listing, no public exploit or Nuclei template, and only one tracked downstream dependent, so active exploitation is currently unlikely — but PraisonAI already carries 153 other CVEs and a 0/100 package risk score, which is worth flagging to any team relying on it. Patch to praisonai 4.6.58+ immediately, and in the meantime block Jobs-worker egress to RFC1918 ranges and 169.254.169.254 and enforce IMDSv2 on any cloud host running it.

Sources:NVDGitHub AdvisoryCISA KEVATLAS

What is the risk?

Medium overall risk (CVSS 6.8, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Exploitability is constrained by AC:H — the attacker needs to win a DNS-rebinding-style race or reliably trigger a resolution failure at the right moment, so this isn't a point-and-click exploit. However, no privileges or user interaction are required, the scope is changed (impact extends beyond the vulnerable component to whatever the SSRF can reach), and confidentiality impact is high given the potential to hit cloud metadata services. Mitigating factors: not in CISA KEV, no EPSS data (implying low observed/predicted exploitation activity), no public PoC or Nuclei template, and a small blast radius (1 tracked downstream dependent). Aggravating factor: the package has 153 other recorded CVEs and a package risk score of 0/100, indicating broader security debt in the codebase that increases the chance of adjacent, easier-to-chain flaws.

How does the attack unfold?

Webhook Registration

Attacker submits a PraisonAI Jobs API webhook_url pointing to an attacker-controlled domain with a short DNS TTL, which resolves to a benign public IP at validation time.

AML.T0049

TOCTOU / Fail-Open Bypass

Attacker re-points the DNS record to an internal address (127.0.0.1 or 169.254.169.254) or forces a socket.gaierror during re-resolution, exploiting the fail-open path so the validated address is never bound to the address used in the actual request.

SSRF to Internal/Metadata Endpoint

The Jobs worker issues the webhook callback to the now-internal address, reaching localhost services or the cloud instance metadata service from the server's trusted network context.

AML.T0075

Credential/Data Exposure

Response content — such as temporary cloud IAM credentials from the metadata service or internal service data — flows back to the attacker via the webhook response path, enabling further lateral movement.

AML.T0055

Webhook Registration

Attacker submits a PraisonAI Jobs API webhook_url pointing to an attacker-controlled domain with a short DNS TTL, which resolves to a benign public IP at validation time.

AML.T0049

TOCTOU / Fail-Open Bypass

Attacker re-points the DNS record to an internal address (127.0.0.1 or 169.254.169.254) or forces a socket.gaierror during re-resolution, exploiting the fail-open path so the validated address is never bound to the address used in the actual request.

SSRF to Internal/Metadata Endpoint

The Jobs worker issues the webhook callback to the now-internal address, reaching localhost services or the cloud instance metadata service from the server's trusted network context.

AML.T0075

Credential/Data Exposure

Response content — such as temporary cloud IAM credentials from the metadata service or internal service data — flows back to the attacker via the webhook response path, enabling further lateral movement.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.48	`4.6.58`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade to praisonai >= 4.6.58, which fixes the fail-open path and binds the validated address to the request. 2) Until patched, add network-layer egress controls on the Jobs worker process denying outbound connections to RFC1918/loopback ranges and 169.254.169.254. 3) Enforce IMDSv2 (token-required metadata requests) on any cloud host running PraisonAI so a bare SSRF GET can't retrieve credentials even if it reaches the metadata endpoint. 4) If webhook callbacks aren't a required feature, disable the Jobs webhook capability entirely. 5) For detection, monitor for outbound requests from the PraisonAI process to internal IP ranges or the metadata address, and alert on webhook_url values that resolve to different IPs across successive DNS lookups (a DNS-rebinding signature).

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-55535?

PraisonAI's Jobs API lets a caller register a webhook_url for job callbacks, but validate_webhook_url() fails open when DNS resolution throws socket.gaierror and never binds the address it validated to the address actually used when the request is later made. That gap lets an attacker who controls DNS for their webhook domain pass validation against a benign public IP, then flip the record to 127.0.0.1 or the cloud metadata address 169.254.169.254 before the real request fires — a classic TOCTOU SSRF. The CVSS 6.8 score reflects high attack complexity (timing a DNS change or forcing a resolution failure is nontrivial) but high confidentiality impact and a changed scope, since a successful hit can reach internal services or exfiltrate cloud IAM credentials from the metadata endpoint. There's no EPSS score, no CISA KEV listing, no public exploit or Nuclei template, and only one tracked downstream dependent, so active exploitation is currently unlikely — but PraisonAI already carries 153 other CVEs and a 0/100 package risk score, which is worth flagging to any team relying on it. Patch to praisonai 4.6.58+ immediately, and in the meantime block Jobs-worker egress to RFC1918 ranges and 169.254.169.254 and enforce IMDSv2 on any cloud host running it.

Is CVE-2026-55535 actively exploited?

No confirmed active exploitation of CVE-2026-55535 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55535?

1) Upgrade to praisonai >= 4.6.58, which fixes the fail-open path and binds the validated address to the request. 2) Until patched, add network-layer egress controls on the Jobs worker process denying outbound connections to RFC1918/loopback ranges and 169.254.169.254. 3) Enforce IMDSv2 (token-required metadata requests) on any cloud host running PraisonAI so a bare SSRF GET can't retrieve credentials even if it reaches the metadata endpoint. 4) If webhook callbacks aren't a required feature, disable the Jobs webhook capability entirely. 5) For detection, monitor for outbound requests from the PraisonAI process to internal IP ranges or the metadata address, and alert on webhook_url values that resolve to different IPs across successive DNS lookups (a DNS-rebinding signature).

What systems are affected by CVE-2026-55535?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook-based job orchestration, multi-agent orchestration pipelines.

What is the CVSS score for CVE-2026-55535?

CVE-2026-55535 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook-based job orchestrationmulti-agent orchestration pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

Exploitation Scenario

An attacker registers a domain with a very short DNS TTL and submits it as the webhook_url for a PraisonAI job. At validation time, the domain resolves to an innocuous public IP and passes validate_webhook_url()'s checks. Before the job's actual callback fires, the attacker either re-points the DNS record to 169.254.169.254 (cloud metadata) or 127.0.0.1, or forces the second resolution to throw socket.gaierror — both of which the fail-open logic lets through unchecked because the validated address was never bound to the address used in the real request. When the Jobs worker executes the callback, it unknowingly makes an authenticated-context request to the internal address, and any response (e.g., temporary IAM credentials from the metadata service, or data from an internal admin endpoint) is returned to the attacker via the webhook response, giving them a foothold to pivot deeper into the victim's cloud environment.

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionPrimary CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionPrimary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition CWE-918Server-Side Request Forgery (SSRF)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.