Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-60091

PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MervinPraison PraisonAI

Default version status: unaffected

  • 0 to < 4.6.78affected
  • 4.6.78unaffected
pkg:pypi/praisonai

References