CVE-2026-55535CWE-367CWE-918ssrf

CVE-2026-55535

Medium · published August 25, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-25T19:16Z
References (4)
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:36Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:01Z
    PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
    cvelistv5