CVE-2026-57143: PraisonAI SSRF — HIGH

CISO Take

PraisonAI's default search tools (searxng_search and the search_web SearxNG provider) pass an LLM-controlled searxng_url straight to requests.get with no scheme, host, port or address validation, so a prompt-injected agent can be steered into server-side requests against internal services and cloud-metadata endpoints. Responses from internal JSON services flow back into the agent context, and open versus closed ports can be told apart, which makes this a useful internal reconnaissance and data-exposure primitive (CVSS 8.8, scope changed, high confidentiality impact). There is no KEV listing, no EPSS data, no public exploit and no Nuclei template at this time, so exploitation is not currently observed, but the attack needs only attacker-controlled text that the agent reads, such as a web page or document. Upgrade praisonaiagents to 1.6.62 or later, and until then disable the SearxNG search tool and block agent hosts from reaching link-local metadata addresses (169.254.169.254) and internal admin interfaces.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Exploitation is low complexity and needs no privileges, only that the agent processes attacker-influenced content (user interaction is required in the CVSS vector). The changed scope reflects that the agent host can be used to reach network segments and services the attacker cannot reach directly. Likelihood is raised by the fact that agents routinely ingest untrusted web and document content. There is no evidence of active exploitation, no KEV entry, no EPSS score and no public exploit. Downstream dependents and package scorecard data are unknown, so blast radius is unquantified. Exposure is greatest for agents running in cloud environments with IMDSv1 or permissive internal networks, and for deployments where search results and tool output are returned to users or logged.

How does the attack unfold?

Initial Access

Attacker plants hidden instructions in web content or documents that the PraisonAI agent ingests.

AML.T0051.001

Tool Abuse

The injected prompt makes the agent call searxng_search with an attacker-chosen internal or metadata URL.

AML.T0053

Discovery

The agent host issues requests to internal services and metadata endpoints, revealing open ports and returning JSON.

AML.T0075

Impact

Internal data and possibly cloud credentials enter agent context and can be leaked through agent output or further tool calls.

AML.T0086

Initial Access

Attacker plants hidden instructions in web content or documents that the PraisonAI agent ingests.

AML.T0051.001

Tool Abuse

The injected prompt makes the agent call searxng_search with an attacker-chosen internal or metadata URL.

AML.T0053

Discovery

The agent host issues requests to internal services and metadata endpoints, revealing open ports and returning JSON.

AML.T0075

Impact

Internal data and possibly cloud credentials enter agent context and can be leaked through agent output or further tool calls.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI Agents	pip	—	No patch
20 dependents63% patched~21d to patchFull package profile →

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CHigh

ILow

ALow

What should I do?

1 step

1) Upgrade praisonaiagents to 1.6.62 or later (see GHSA-4pcv-mg8v-vrgf and the linked commit). 2) Until patched, remove or disable searxng_search and the SearxNG provider in search_web, or hard-code the SearxNG URL in configuration so the model cannot override it. 3) Enforce egress filtering from agent hosts: deny access to 169.254.169.254, loopback, RFC1918 ranges and internal admin ports except for explicitly allowed destinations. 4) Require IMDSv2 (or equivalent metadata protections) and use least-privilege, short-lived workload credentials. 5) Detect: alert on agent-originated outbound requests to internal or link-local addresses, unusual hosts in search tool parameters, and tool-call logs where searxng_url differs from the configured value. 6) Treat all retrieved web content as untrusted and apply tool-argument allowlists and human approval for tools that make network requests.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt InjectionData ExtractionData LeakageAgentFrameworkPluginAML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0075- Cloud Service Discovery AML.T0085.001- AI Agent Tools AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57143?

PraisonAI's default search tools (searxng_search and the search_web SearxNG provider) pass an LLM-controlled searxng_url straight to requests.get with no scheme, host, port or address validation, so a prompt-injected agent can be steered into server-side requests against internal services and cloud-metadata endpoints. Responses from internal JSON services flow back into the agent context, and open versus closed ports can be told apart, which makes this a useful internal reconnaissance and data-exposure primitive (CVSS 8.8, scope changed, high confidentiality impact). There is no KEV listing, no EPSS data, no public exploit and no Nuclei template at this time, so exploitation is not currently observed, but the attack needs only attacker-controlled text that the agent reads, such as a web page or document. Upgrade praisonaiagents to 1.6.62 or later, and until then disable the SearxNG search tool and block agent hosts from reaching link-local metadata addresses (169.254.169.254) and internal admin interfaces.

Is CVE-2026-57143 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57143, increasing the risk of exploitation.

How to fix CVE-2026-57143?

1) Upgrade praisonaiagents to 1.6.62 or later (see GHSA-4pcv-mg8v-vrgf and the linked commit). 2) Until patched, remove or disable searxng_search and the SearxNG provider in search_web, or hard-code the SearxNG URL in configuration so the model cannot override it. 3) Enforce egress filtering from agent hosts: deny access to 169.254.169.254, loopback, RFC1918 ranges and internal admin ports except for explicitly allowed destinations. 4) Require IMDSv2 (or equivalent metadata protections) and use least-privilege, short-lived workload credentials. 5) Detect: alert on agent-originated outbound requests to internal or link-local addresses, unusual hosts in search tool parameters, and tool-call logs where searxng_url differs from the configured value. 6) Treat all retrieved web content as untrusted and apply tool-argument allowlists and human approval for tools that make network requests.

What systems are affected by CVE-2026-57143?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, tool-using LLM agents, cloud-hosted agent deployments.

What is the CVSS score for CVE-2026-57143?

CVE-2026-57143 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemstool-using LLM agentscloud-hosted agent deployments

MITRE ATLAS Techniques

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0075Cloud Service Discovery

AML.T0085.001AI Agent Tools

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

Exploitation Scenario

An attacker publishes a web page or document containing hidden instructions and gets a PraisonAI research agent to read it, for example through a prior search result, a shared file or an inbound message. The injected text tells the agent to call searxng_search with searxng_url set to http://169.254.169.254/ or an internal service address. The tool issues the request from the agent host, and the JSON response lands in the agent context. The attacker then has the agent echo or forward the data, or iterates over internal ports and observes error versus success behavior to map the internal network and find services that expose credentials or sensitive data.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-20Improper Input Validation CWE-918Server-Side Request Forgery (SSRF)

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.