CVE-2026-61430: PraisonAI DNS rebinding SSRF bypass

CISO Take

PraisonAI's web_crawl tool validates a requested hostname against SSRF protections at check time but re-resolves the DNS name when it actually opens the connection, so an attacker who controls a domain can flip its DNS record between the two lookups and make the agent fetch internal or loopback services instead of the originally-validated public target. This scores CVSS 8.5 (network vector, low complexity, no user interaction, scope change) because the response body of whatever internal service gets hit — internal APIs, admin panels, cloud metadata endpoints — flows straight back through the agent's output to the attacker. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this isn't under active mass exploitation, but DNS rebinding is a well-documented, easily-scripted technique, and the package already carries 138 other CVEs, which should weigh into any vendor risk assessment. Patch to PraisonAI 1.6.78 or later immediately; if you can't patch today, block the gap at the network layer with an egress proxy or policy that denies RFC1918/loopback/169.254.169.254 ranges regardless of what the application-layer hostname check decides, since app-layer SSRF filters are exactly what this bug defeats. For detection, watch for the agent process issuing two DNS resolutions for the same hostname within a short window immediately before an outbound connection — that pattern is the signature of a rebinding attempt.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High-severity, low-complexity, unauthenticated-effort SSRF that only requires low privileges (agent/API access) and no user interaction, making it easy to weaponize once an attacker can direct the web_crawl tool at an attacker-controlled domain. Exploitability is currently theoretical in the wild (no KEV entry, no EPSS percentile, no public PoC or scanner template), which lowers near-term urgency, but the technique itself (DNS rebinding to defeat TOCTOU hostname validation) is mature, well-understood, and trivially automatable with existing open-source rebinding frameworks. The confidentiality impact is high (internal response bodies are exfiltrated) while integrity impact is limited and availability is unaffected, so the primary risk is information disclosure of internal network state rather than system takeover. Given the package's poor overall security track record (138 other CVEs) and its role as an agent framework with outbound network capability, this should be treated as high priority to patch even absent active exploitation signals.

How does the attack unfold?

Initial Access

Attacker with low-privilege access to the agent (API, chat interface, or indirect prompt injection) directs the web_crawl tool to fetch a URL on an attacker-controlled domain.

AML.T0053

Validation Bypass Setup

PraisonAI checks the hostname against SSRF protections; the domain currently resolves to a permitted public IP, so the check passes.

AML.T0049

DNS Rebinding

The attacker rapidly updates the domain's DNS record so the second resolution at actual connection time returns an internal or loopback IP address, bypassing the earlier validation.

Impact / Exfiltration

PraisonAI connects to the rebound internal IP and returns the internal HTTP response body — potentially cloud metadata credentials or internal API data — back through the agent's output to the attacker.

AML.T0086

Initial Access

Attacker with low-privilege access to the agent (API, chat interface, or indirect prompt injection) directs the web_crawl tool to fetch a URL on an attacker-controlled domain.

AML.T0053

Validation Bypass Setup

PraisonAI checks the hostname against SSRF protections; the domain currently resolves to a permitted public IP, so the check passes.

AML.T0049

DNS Rebinding

The attacker rapidly updates the domain's DNS record so the second resolution at actual connection time returns an internal or loopback IP address, bypassing the earlier validation.

Impact / Exfiltration

PraisonAI connects to the rebound internal IP and returns the internal HTTP response body — potentially cloud metadata credentials or internal API data — back through the agent's output to the attacker.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

Upgrade PraisonAI to version 1.6.78 or later, which is expected to add IP pinning so the resolved IP used for the connection matches the IP validated at check time. Until patched, restrict the agent's outbound network path independently of the application: deploy an egress proxy or network policy (iptables, cloud security group, service mesh) that blocks connections to RFC1918 private ranges, 127.0.0.0/8, 169.254.169.254 and other cloud metadata addresses, and link-local ranges. Run the web_crawl tool in a network-isolated sandbox or container namespace with no route to internal services as defense-in-depth against future TOCTOU-class bugs in this or other tools. For detection, log and alert on agent-initiated DNS resolutions that return two different IPs for the same hostname within a short time window, and monitor for outbound connections from the agent process to private/loopback address ranges.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-2.3 - AI risks and benefits are continually monitored and managed

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61430?

PraisonAI's web_crawl tool validates a requested hostname against SSRF protections at check time but re-resolves the DNS name when it actually opens the connection, so an attacker who controls a domain can flip its DNS record between the two lookups and make the agent fetch internal or loopback services instead of the originally-validated public target. This scores CVSS 8.5 (network vector, low complexity, no user interaction, scope change) because the response body of whatever internal service gets hit — internal APIs, admin panels, cloud metadata endpoints — flows straight back through the agent's output to the attacker. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template yet, so this isn't under active mass exploitation, but DNS rebinding is a well-documented, easily-scripted technique, and the package already carries 138 other CVEs, which should weigh into any vendor risk assessment. Patch to PraisonAI 1.6.78 or later immediately; if you can't patch today, block the gap at the network layer with an egress proxy or policy that denies RFC1918/loopback/169.254.169.254 ranges regardless of what the application-layer hostname check decides, since app-layer SSRF filters are exactly what this bug defeats. For detection, watch for the agent process issuing two DNS resolutions for the same hostname within a short window immediately before an outbound connection — that pattern is the signature of a rebinding attempt.

Is CVE-2026-61430 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61430, increasing the risk of exploitation.

How to fix CVE-2026-61430?

Upgrade PraisonAI to version 1.6.78 or later, which is expected to add IP pinning so the resolved IP used for the connection matches the IP validated at check time. Until patched, restrict the agent's outbound network path independently of the application: deploy an egress proxy or network policy (iptables, cloud security group, service mesh) that blocks connections to RFC1918 private ranges, 127.0.0.0/8, 169.254.169.254 and other cloud metadata addresses, and link-local ranges. Run the web_crawl tool in a network-isolated sandbox or container namespace with no route to internal services as defense-in-depth against future TOCTOU-class bugs in this or other tools. For detection, log and alert on agent-initiated DNS resolutions that return two different IPs for the same hostname within a short time window, and monitor for outbound connections from the agent process to private/loopback address ranges.

What systems are affected by CVE-2026-61430?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool invocation, web retrieval/crawling tools.

What is the CVSS score for CVE-2026-61430?

CVE-2026-61430 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool invocationweb retrieval/crawling tools

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

Exploitation Scenario

An attacker with low-privilege access to a PraisonAI-based agent (e.g., via an exposed API endpoint, a chat interface, or an indirect prompt injection that gets the agent to call the tool) instructs the web_crawl tool to fetch a URL on a domain the attacker controls. The attacker's DNS server initially answers with a public, allow-listed IP address, so PraisonAI's hostname check passes. Immediately after the check but before (or during) the actual connection, the attacker changes the DNS record for that domain to point to an internal address such as 127.0.0.1, an internal service IP, or 169.254.169.254. Because PraisonAI re-resolves the hostname at connection time instead of pinning the IP it validated, it connects to the newly-resolved internal address, retrieves the internal HTTP response (for example, cloud instance metadata containing temporary IAM credentials, or an internal admin API), and returns that content to the attacker through the agent's normal output channel.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.