Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
4205 articles · 197367 vulns · 37/41 feeds (7d)
← Back to list
7.1
CVE-2026-55537PATCHED
mervinpraison · praisonai

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.

Affected Products

VendorProductVersions
mervinpraisonpraisonai< 4.6.58

References

  • https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rg5q-pp8p-f7jm(x_refsource_CONFIRM)
  • https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1(x_refsource_MISC)
  • https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58(x_refsource_MISC)

Related News (1 articles)

Tier C
VulDB6h ago
CVE-2026-55537 | MervinPraison PraisonAI up to 4.6.57 Webhook Validation JobSubmitRequest.validate_webhook_url server-side request forgery
→ No new info (linked only)
CVSS 3.17.1 HIGH
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CISA KEV❌ No
Actively exploited❌ No
Patch available
PraisonAI@4.6.58
CWECWE-367, CWE-705, CWE-918
PublishedAug 25, 2026
Trending Score34
Source articles1
Independent1
Info Completeness0/14
Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
Trending: 44
HIGHCVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Trending: 44
HIGHCVE-2026-55525
PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl
Trending: 44
HIGHCVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Trending: 36
NONECVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Trending: 34

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Aug 25, 2026
Discovered by ZDM
Aug 25, 2026
Patch Available
Aug 25, 2026