CVE-2026-57115: PraisonAI Agents SSRF

CISO Take

PraisonAI's SpiderTools.scrape_page validates only the initial URL before fetching, then lets the underlying HTTP session follow redirects automatically — so a public-looking link can silently redirect to loopback, private, link-local, or cloud metadata addresses, and the response body flows straight back through extract_links, crawl, and extract_text to whoever invoked the agent. This is classic SSRF (CWE-918) with high confidentiality impact and no privileges required, though exploitation does require user interaction — typically an operator, or an agent instructed via indirect prompt injection, to scrape an attacker-supplied URL. There is no CISA KEV listing, no EPSS score, no public exploit code or Nuclei template yet, and the package carries an internal risk score of 0/100 with unknown downstream dependents, so this reads as a real but not currently weaponized exposure. Because agentic frameworks routinely run with cloud IAM roles attached, the practical danger is credential theft from instance metadata (169.254.169.254) or reachability into internal admin services via the agent's own network position. Patch to praisonaiagents 1.6.59 immediately, and in the meantime block agent egress to RFC1918/loopback/link-local ranges and the cloud metadata IP at the network or proxy layer.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CVSS 6.5 (medium) with AV:N/AC:L/PR:N reflects that exploitation is technically trivial once a malicious or redirecting URL reaches the scraper, but UI:R means the attacker still needs a delivery mechanism — either convincing an operator to scrape a link or poisoning content that the agent autonomously decides to crawl. Impact is confidentiality-only (C:H/I:N/A:N), consistent with SSRF's typical outcome of data disclosure rather than system takeover. With no KEV listing, no EPSS score, no public PoC, and no Nuclei coverage, current real-world exploitation activity appears to be zero. However, the structural risk is elevated for agentic deployments specifically, because these agents often sit on hosts with cloud IAM roles and unrestricted outbound network access — turning a garden-variety SSRF into a potential credential-theft primitive.

How does the attack unfold?

Malicious URL delivery

Attacker plants or supplies a public-looking URL that issues an HTTP redirect, delivered via direct request or content the agent is told to scrape.

AML.T0093

Tool invocation

The PraisonAI agent calls SpiderTools.scrape_page (or extract_links/crawl) with the attacker-supplied URL.

AML.T0053

SSRF redirect exploitation

requests.Session follows the redirect without revalidation, reaching a loopback, private, link-local, or cloud metadata address normally blocked from the outside.

AML.T0049

Sensitive data disclosure

The redirected response body (potentially containing cloud credentials or internal service data) is returned through extract_text/crawl and surfaced in the agent's output.

AML.T0057

Malicious URL delivery

Attacker plants or supplies a public-looking URL that issues an HTTP redirect, delivered via direct request or content the agent is told to scrape.

AML.T0093

Tool invocation

The PraisonAI agent calls SpiderTools.scrape_page (or extract_links/crawl) with the attacker-supplied URL.

AML.T0053

SSRF redirect exploitation

requests.Session follows the redirect without revalidation, reaching a loopback, private, link-local, or cloud metadata address normally blocked from the outside.

AML.T0049

Sensitive data disclosure

The redirected response body (potentially containing cloud credentials or internal service data) is returned through extract_text/crawl and surfaced in the agent's output.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade praisonaiagents to >=1.6.59 immediately. If immediate patching isn't possible, block outbound egress from hosts running the agent to 169.254.169.254 (cloud metadata), 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and fc00::/7 at the firewall or an egress proxy. Where possible, run the agent through an SSRF-aware proxy that resolves and validates every redirect hop's IP against a denylist rather than trusting the destination host blindly. Monitor agent/tool-invocation logs for scrape_page or crawl calls targeting IP literals or internal-sounding hostnames, and alert on scraped content containing metadata markers such as 'iam/security-credentials' or 'computeMetadata'. Apply least-privilege IAM roles to any host running PraisonAI agents, since SSRF-to-metadata is the standard path to credential theft.

How is it classified?

Data Leakage Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0057 - LLM Data Leakage

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57115?

PraisonAI's SpiderTools.scrape_page validates only the initial URL before fetching, then lets the underlying HTTP session follow redirects automatically — so a public-looking link can silently redirect to loopback, private, link-local, or cloud metadata addresses, and the response body flows straight back through extract_links, crawl, and extract_text to whoever invoked the agent. This is classic SSRF (CWE-918) with high confidentiality impact and no privileges required, though exploitation does require user interaction — typically an operator, or an agent instructed via indirect prompt injection, to scrape an attacker-supplied URL. There is no CISA KEV listing, no EPSS score, no public exploit code or Nuclei template yet, and the package carries an internal risk score of 0/100 with unknown downstream dependents, so this reads as a real but not currently weaponized exposure. Because agentic frameworks routinely run with cloud IAM roles attached, the practical danger is credential theft from instance metadata (169.254.169.254) or reachability into internal admin services via the agent's own network position. Patch to praisonaiagents 1.6.59 immediately, and in the meantime block agent egress to RFC1918/loopback/link-local ranges and the cloud metadata IP at the network or proxy layer.

Is CVE-2026-57115 actively exploited?

No confirmed active exploitation of CVE-2026-57115 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57115?

Upgrade praisonaiagents to >=1.6.59 immediately. If immediate patching isn't possible, block outbound egress from hosts running the agent to 169.254.169.254 (cloud metadata), 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and fc00::/7 at the firewall or an egress proxy. Where possible, run the agent through an SSRF-aware proxy that resolves and validates every redirect hop's IP against a denylist rather than trusting the destination host blindly. Monitor agent/tool-invocation logs for scrape_page or crawl calls targeting IP literals or internal-sounding hostnames, and alert on scraped content containing metadata markers such as 'iam/security-credentials' or 'computeMetadata'. Apply least-privilege IAM roles to any host running PraisonAI agents, since SSRF-to-metadata is the standard path to credential theft.

What systems are affected by CVE-2026-57115?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, web scraping/crawling pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-57115?

CVE-2026-57115 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksweb scraping/crawling pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0057 LLM Data Leakage

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.

Exploitation Scenario

An attacker plants a link — on a webpage, in a support ticket, or in search results — that looks benign (e.g., a URL shortener) but issues an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>. A research or OSINT agent built on PraisonAI is asked, directly by a user or indirectly through content it was told to summarize, to 'scrape and summarize this page.' SpiderTools.scrape_page fetches the outer URL; the underlying requests.Session transparently follows the redirect to the cloud metadata endpoint without revalidating that the new destination is still public. The resulting JSON — containing temporary IAM credentials — is returned as scraped text through extract_text, and the agent dutifully repeats it in its output, handing the attacker valid cloud credentials for lateral movement.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.