PYSEC-2026-3890

    Dashboard / Vulnerabilities / PYSEC-2026-3890

    PYSEC-2026-3890

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

    Details: ### Summary The `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request. ### Details The validator catches `socket.gaierror` and silently allows the URL: ```python # src/praisonai/praisonai/jobs/models.py:55 try: ip = socket.gethostbyname(hostname) ip_obj = ipaddress.ip_address(ip) if ip_obj.is_private or ip_obj.is_loopback: raise ValueError("private address") except socket.gaierror: pass # BUG: DNS failure silently ignored → SSRF bypass ``` The HTTP call is made later with no re-validation: ```python # src/praisonai/praisonai/jobs/executor.py:402 async with httpx.AsyncClient() as client: await client.post(job.webhook_url, ...) # no second IP check ``` ### Proof of Concept **DNS rebinding flow:** 1. Register `attacker.com` with TTL=1s → resolves to `1.2.3.4` (public IP) 2. Submit job: `webhook_url=http://attacker.com/callback` 3. Validation passes (public IP) 4. Switch DNS: `attacker.com` → `127.0.0.1` 5. Job completes → server POSTs to `127.0.0.1` → internal SSRF **Unresolvable domain bypass (no DNS rebinding required):** ```bash curl -X POST http://:8005/api/v1/runs \ -d '{"prompt":"run","webhook_url":"http://unresolvable.internal/cb","agent_yaml":"..."}' # Validation: gaierror → pass → URL accepted ``` ### Impact SSRF to internal HTTP services: admin panels, databases, and cloud metadata APIs (e.g., `http://169.254.169.254/`). Exploitable without authentication.

    References: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9, https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1, https://github.com/MervinPraison/PraisonAI, https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58, https://pypi.org/project/praisonai, https://github.com/advisories/GHSA-hmfx-4v44-9qw9, https://nvd.nist.gov/vuln/detail/CVE-2026-55535

    Affected packages

    Package

    Name: praisonai

    Purl: pkg:pypi/praisonai

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.6.58

    Affected versions

    0.0.1
    0.0.10
    0.0.11
    0.0.12
    0.0.13
    0.0.14
    0.0.15
    0.0.16
    0.0.17
    0.0.18
    0.0.19
    0.0.2
    0.0.20
    0.0.21
    0.0.22
    0.0.23
    0.0.24
    0.0.25
    0.0.26
    0.0.27
    0.0.28
    0.0.29
    0.0.3
    0.0.30
    0.0.31
    0.0.32
    0.0.33
    0.0.34
    0.0.35
    0.0.36
    0.0.37
    0.0.38
    0.0.39
    0.0.4
    0.0.40
    0.0.41
    0.0.42
    0.0.43
    0.0.44
    0.0.45
    0.0.46
    0.0.47
    0.0.48
    0.0.49
    0.0.5
    0.0.50
    0.0.52
    0.0.53
    0.0.54
    0.0.55
    0.0.56
    0.0.57
    0.0.58
    0.0.59
    0.0.59rc11
    0.0.59rc2
    0.0.59rc3
    0.0.59rc5
    0.0.59rc6
    0.0.59rc7
    0.0.59rc8
    0.0.59rc9
    0.0.6
    0.0.61
    0.0.64
    0.0.65
    0.0.66
    0.0.67
    0.0.68
    0.0.69
    0.0.7
    0.0.70
    0.0.71
    0.0.72
    0.0.73
    0.0.74
    0.0.8
    0.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2026-3890 | CVE-DB