CVE-2026-40160

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542	Exploit Vendor Advisory
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) PraisonAIAgents es un sistema de equipos multiagente. Antes de la versión 1.5.128, la ruta de respaldo httpx de web_crawl pasa las URL proporcionadas por el usuario directamente a httpx.AsyncClient.get() con follow_redirects=True y sin validación de host. Un agente LLM engañado para rastrear una URL interna puede alcanzar puntos finales de metadatos en la nube (169.254.169.254), servicios internos y localhost. El contenido de la respuesta se devuelve al agente y puede aparecer en la salida visible para el atacante. Esta ruta de respaldo es la ruta de rastreo predeterminada en una instalación nueva de PraisonAI (sin clave de Tavily, sin Crawl4AI instalado). Esta vulnerabilidad está corregida en la versión 1.5.128.

Information

Published : 2026-04-10 17:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40160

Mitre link : CVE-2026-40160

CVE.ORG link : CVE-2026-40160

JSON object : View

Products Affected

praison

praisonaiagents

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-40160", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40160", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:28:31.603808Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAIAgents", "versions": [{"status": "affected", "version": "< 1.5.128"}]}]}], "published": "2026-04-10T17:17:13.950", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128."}, {"lang": "es", "value": "PraisonAIAgents es un sistema de equipos multiagente. Antes de la versi\u00f3n 1.5.128, la ruta de respaldo httpx de web_crawl pasa las URL proporcionadas por el usuario directamente a httpx.AsyncClient.get() con follow_redirects=True y sin validaci\u00f3n de host. Un agente LLM enga\u00f1ado para rastrear una URL interna puede alcanzar puntos finales de metadatos en la nube (169.254.169.254), servicios internos y localhost. El contenido de la respuesta se devuelve al agente y puede aparecer en la salida visible para el atacante. Esta ruta de respaldo es la ruta de rastreo predeterminada en una instalaci\u00f3n nueva de PraisonAI (sin clave de Tavily, sin Crawl4AI instalado). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.5.128."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1797C27-7EBC-4CEF-90B8-F84E8198632D", "versionEndExcluding": "1.5.128"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}